API Testing Guide

Comprehensive API validation covering functional correctness, security, and performance across all services and third-party integrations.

Test Strategy

When setting up API tests for a new service, create a base test class with shared auth, retry logic, and response validation helpers before writing individual test cases. This prevents duplicated setup code and ensures consistent assertion patterns across the suite.

See Test Suite for the full vitest + fetch test suite code.

Security Checklist

Cover the OWASP API Security Top 10 in every test suite:

• Authentication/Authorization: Test that unauthenticated requests return 401, and unauthorized requests return 403. Verify token expiration, refresh flows, and privilege escalation attempts.
• Input sanitization: Test SQL injection, XSS payloads, and command injection via query parameters, request bodies, and headers.
• Rate limiting: Verify that burst requests trigger 429 responses. Test per-user and per-IP limits.
• Mass assignment: Send unexpected fields in POST/PATCH requests and verify they are ignored.
• BOLA (Broken Object-Level Authorization): Request resources belonging to other users and verify 403/404 responses.