Comprehensive API testing patterns including contract testing, REST/GraphQL testing, and integration testing. Use when testing APIs or designing API test strategies.

API Testing Patterns <default to action When testing APIs or designing API test strategy: 1. IDENTIFY testing level: contract, integration, or component 2. TEST the contract, not implementation (consumer perspective) 3. VALIDATE auth, input, errors, idempotency, concurrency 4. AUTOMATE in CI/CD with schema validation 5. MONITOR production APIs for contract drift Quick Pattern Selection: Microservices → Consumer driven contracts (Pact) REST APIs → CRUD + pagination + filtering tests GraphQL → Query validation + complexity limits External deps → Mock with component testing Performance → Load test critical endpoints Critical Success Factors: APIs are contracts test from consumer perspective Always test error scenarios, not just happy paths Version your API tests to prevent breaking changes </default to action Quick Reference Card When to Use Testing REST or GraphQL APIs Validating microservice contracts Designing API test strategies Preventing breaking API changes Testing Levels Level Purpose Dependencies Speed Contract Provider consumer agreement None Fast Component API in isolation Mocked Fast Integration Real dependencies Database, services Slower Critical Test Scenarios Scenario Must Test Example Auth 401/403 handling Expired token, wrong user Input 400 validation Missing fields, wrong types Errors 500 graceful handling DB down, timeout Idempotency Duplicate prevention Same idempotency key Concurrency Race conditions Parallel checkout Tools Contract : Pact, Spring Cloud Contract REST : Supertest, REST assured, Playwright Load : k6, Artillery, JMeter Agent Coordination qe api contract validator : Validate contracts, detect breaking changes qe test generator : Generate tests from OpenAPI spec qe performance tester : Load test endpoints qe security scanner : API security testing Contract Testing Pattern: Consumer Driven Contracts When: Microservices, distributed systems, third party integrations Critical Test Patterns Authentication & Authorization Input Validation Idempotency Concurrency REST CRUD Pattern Best Practices ✅ Do This Test from consumer perspective Use schema validation (not exact values) Test error scenarios extensively Version API tests Automate in CI/CD ❌ Avoid This Testing implementation, not contract Ignoring HTTP semantics (status codes) No negative testing Asserting on field order or extra fields Slow tests (mock external services) Agent Assisted API Testing Agent Coordination Hints Memory Namespace Fleet Coordination Related Skills [agentic quality engineering](../agentic quality engineering/) API testing with agents [tdd london chicago](../tdd london chicago/) London school for API testing [performance testing](../performance testing/) API load testing [security testing](../security testing/) API security validation [contract testing](../contract testing/) Consumer driven contracts deep dive Remember API testing = verifying contracts and behavior, not implementation. Focus on what matters to consumers: correct responses, proper error handling, acceptable performance. With Agents: Agents automate contract validation, generate comprehensive test suites from specs, and monitor production APIs for drift. Use agents to maintain API quality at scale. Gotchas Agent generates tests against documented API, not actual API — always validate against running service first Auth tokens expire between test runs — use fixtures with long lived tokens or refresh before each suite Rate limiting in CI causes intermittent failures — add retry with exponential backoff for 429 responses GraphQL introspection may be disabled in production — test against staging schema, not production endpoint Idempotency tests need unique request IDs per run — hardcoded IDs cause false passes on retry

api-testing-patterns