["Test authentication and authorization on every endpoint","Use contract tests to catch breaking changes before deployment","Run load tests against staging, never production","Fuzz boundary conditions (empty strings, max integers, unicode)"]
error_handling
graceful
source
builtin
trust_score
100
provenance_sha
65133b6e97f991e4
API Testing
Purpose
Comprehensive API testing and security validation skill covering REST, GraphQL, and gRPC endpoints. Provides structured workflows for functional testing, contract testing, load testing, fuzzing, and OWASP API Top 10 security checks using Bruno, Hurl, k6, Postman, and httpie.
When to Invoke
Skill({ skill: 'api-testing' });
Invoke when:
Validating a new or modified REST/GraphQL/gRPC API
Running contract tests before a deployment
Performing an OWASP API Top 10 security audit
Setting up load or soak tests for an endpoint
Fuzzing request parameters and headers for edge-case bugs
Toolchain
Tool
Purpose
Install
Bruno
Git-native API collection runner
npm i -g @usebruno/cli
Hurl
Plain-text HTTP test runner
cargo install hurl or pkg
k6
JavaScript-based load testing
brew install k6
httpie
Human-friendly curl replacement
pip install httpie
Zap
OWASP automated security scanner
Docker or standalone binary
Nuclei
Template-driven vuln scanner
go install nuclei
Workflow
Step 1: Gather API Specification
Command:
# Try OpenAPI spec first
curl -s http://localhost:3000/openapi.json | jq '.info.title, .paths | keys'# Or check for AsyncAPI / GraphQL introspection
curl -s -X POST http://localhost:4000/graphql \
-H "Content-Type: application/json" \
-d '{"query":"{ __schema { types { name } } }"}' | jq '.data.__schema.types[].name'
Expected output: List of API paths or type names confirming the spec is reachable.
Verify: Exit code 0, valid JSON returned.
Step 2: Functional Testing with Hurl
Write a .hurl file per endpoint group. Each file tests success, error, and boundary cases.
Example — tests/api/users.hurl:
# Create user — success path
POST http://localhost:3000/api/users
Content-Type: application/json
{
"name": "Alice",
"email": "alice@example.com"
}
HTTP 201
[Asserts]
header "Content-Type" contains "application/json"
jsonpath "$.id" isInteger
jsonpath "$.email" == "alice@example.com"
# Missing required field — error path
POST http://localhost:3000/api/users
Content-Type: application/json
{}
HTTP 422
[Asserts]
jsonpath "$.errors[0].field" == "email"
# Boundary: extremely long name
POST http://localhost:3000/api/users
Content-Type: application/json
{
"name": "A",
"email": "b@c.io"
}
HTTP 422
Expected: Server returns NOT_FOUND or INVALID_ARGUMENT, not INTERNAL. mTLS rejects requests without valid client cert.
Related Skills
security-architect — full STRIDE threat modeling and penetration test orchestration
tdd — write failing tests before implementing endpoint changes
qa-workflow — systematic QA validation with fix loops
k8s-security-policies — network policy and pod security for API services
Enforcement Hooks
Input validated against schemas/input.schema.json before execution (when run via script).
Output contract defined in schemas/output.schema.json.
Search Protocol
Before starting any API testing task, search for existing test suites and known patterns:
pnpm search:code "hurl OR k6 OR nuclei OR pact"
pnpm search:code "api security test"
Use Skill({ skill: 'ripgrep' }) for fast pattern matching across test files. Use Skill({ skill: 'code-semantic-search' }) to find existing security test logic by intent.
Memory Protocol (MANDATORY)
Before starting any task, you must query semantic memory and read recent static memory:
