Api Tester Pro

Api Tester Pro

# API Tester Pro

API testing is fragmented across a dozen tools. Postman is bloated and expensive. Bruno, Insomnia, and Hoppscotch each cover different protocols but none cover them all. curl works but requires manual parsing and no assertion framework. AI agents trying to test APIs have no single, structured tool to call — they end up crafting ad-hoc curl commands, manually parsing JSON, and writing fragile shell scripts that fail silently. The result: incomplete test coverage, untested edge cases, no repeatable regression suite, and hours wasted stitching together output from three different tools. API Tester Pro gives AI agents a single command-line interface that covers every major API protocol, automates assertions, generates structured reports, scans for security issues, and benchmarks performance — all in one skill.

What It Does

Frameworks/Standards Covered

| Standard/Framework | Coverage | |---|---| | OpenAPI 3.x / Swagger | Schema validation, endpoint discovery, response contract testing | | GraphQL June 2018 | Query execution, introspection, variable types, error formatting | | WebSocket RFC 6455 | Framing, ping/pong, close handshake, message fragmentation | | gRPC / Protocol Buffers | Unary, server-streaming, client-streaming, bidirectional streaming | | SOAP 1.1 / 1.2 | WSDL-derived templates, XML namespace handling, envelope formatting | | SSE (Server-Sent Events) W3C | Event stream parsing, last-event-id, reconnection, custom event types | | OWASP API Top 10 (2023) | Automated scanning for injection, broken auth, data exposure, rate limiting, mass assignment | | JUnit XML | Test result export for CI/CD pipeline integration | | JSON Schema Draft 2020-12 | Response validation with $ref resolution and if/then/else | | HTTP/1.1 (RFC 7230-7235) | Full method support, caching directives, conditional requests, content negotiation |

Detailed Feature Breakdown

### REST API Testing Craft requests with any HTTP method, customize headers, query parameters, request bodies (JSON, XML, form-data, binary). Supports multipart file uploads, cookie handling, redirect following (with configurable limits), and compression (gzip, deflate, brotli). Response parsing includes automatic content-type detection, pretty-printed body inspection, and raw byte view. ### GraphQL Testing Send queries and mutations with variable definitions. Supports introspection query generation for schema exploration. Handles nullable vs non-null fields, lists, enums, input objects, and custom scalars. Parses error locations in the response for precise debugging. ### WebSocket Testing Open persistent connections, send messages (text and binary), filter incoming frames by event type, measure round-trip latency with timestamped pings. Supports TLS/wss, custom sub-protocols, and per-message deflate. ### gRPC Testing Connect via reflection API or load .proto files directly. Discover services and methods. Send unary requests or establish client/server/bi-directional streams. Serialization handles nested messages, oneof fields, maps, and repeated fields. ### SOAP Testing Load WSDL from URL or file. Generate envelope templates for each operation. Inject parameter values. Handle WS-Security headers and SOAP fault parsing. ### SSE Testing Connect to event streams, filter by event type or data pattern. Track connection state, reconnection attempts, and last-event-id sequencing. Capture metrics on event rate and latency. ### Assertion Engine Define assertions on response status (exact, range, not-equal), headers (exists, equals, matches regex, contains), body (JSONPath value check, regex, substring, schema validation, size checks), and response time (under threshold ms). Assertions are evaluated in order with short-circuit on first failure. ### Performance Benchmarking Run a warmup phase (configurable iterations) then collect samples over a measurement window. Supports concurrent virtual users, ramp-up periods, and think-time simulation. Reports: p50/p90/p99 latency, throughput (req/s), error rate, time series. ### Security Scanning Automated checks: SQL injection patterns in parameters and body, XSS payload reflection, JSON injection, NoSQL injection, path traversal, auth bypass attempts, rate-limit testing, mass assignment probes, excessive data exposure detection, and CORS misconfiguration checks. ### Reporting HTML report includes: executive summary with pass/fail counts, per-test breakdown with request/response details, latency histogram with percentile markers, timeline chart of test execution, environment variables used, and failed assertion details with diff views. JSON export includes full request/response pairs for programmatic analysis.

Usage

### Quick Start ```bash # Install pip install requests websocket-client protobuf pyyaml # Test a REST endpoint python3 scripts/api_tester.py rest GET https://api.example.com/users --assert-status 200 # Test with assertions python3 scripts/api_tester.py rest POST https://api.example.com/users \ --header "Content-Type: application/json" \ --body '{"name":"Test User","email":"test@example.com"}' \ --assert-status 201 \ --assert-json-path '$.id' \ --assert-json-value '$.name' "Test User" # Run a full test suite python3 scripts/api_tester.py run config/my-suite.yaml --env staging --report html # Performance benchmark python3 scripts/api_tester.py benchmark https://api.example.com/endpoint \ --concurrency 10 --duration 30 # Security scan python3 scripts/api_tester.py security https://api.example.com/api/v1 # GraphQL query python3 scripts/api_tester.py graphql https://api.example.com/graphql \ --query "query($id:ID!){user(id:$id){name email}}" \ --variables '{"id":"123"}' # WebSocket test python3 scripts/api_tester.py ws wss://echo.example.com/ws --send '{"type":"ping"}' # SSE stream test python3 scripts/api_tester.py sse https://api.example.com/events --event-type update --timeout 30 ``` ### Configuration Create a YAML test suite file: ```yaml # config/my-suite.yaml name: User API Regression base_url: https://api.example.com env: staging: https://staging-api.example.com prod: https://api.example.com defaults: timeout: 10000 retry_count: 2 headers: Accept: application/json tests: - name: List Users method: GET path: /users assertions: - status: 200 - json_path: "$.length()" value: "> 0" - response_time: "< 500" - name: Create User method: POST path: /users body: name: "{{ random_name }}" email: "{{ random_email }}" assertions: - status: 201 - json_path: "$.id" - json_value: path: "$.name" value: "{{ random_name }}" - name: GraphQL Get User protocol: graphql path: /graphql query: | query getUser($id: ID!) { user(id: $id) { id name email } } variables: id: "1" assertions: - status: 200 - json_path: "$.data.user.name" ``` ### Environment Variable Resolution Use environment variables in requests and assertions: ```bash # Set env export API_BASE_URL=https://api.example.com export API_KEY=sk-123456 # Use in test config # path: "{{ API_BASE_URL }}/users" # header: "Authorization: Bearer {{ API_KEY }}" # Or switch profiles with --env python3 scripts/api_tester.py run config/suite.yaml --env staging ```

Output Format

### Terminal Output ``` === Test Suite: User API Regression === Environment: staging Timestamp: 2026-07-06T16:00:00Z [PASS] GET /users - 200 OK (142ms) Assertions: status=200, json_path=$.length() > 0, response_time < 500 Body size: 2.4 KB [PASS] POST /users - 201 Created (234ms) Assertions: status=201, json_path=$.id exists Created resource: /users/42 [FAIL] GraphQL Get User - GraphQL errors (312ms) Assertions: json_path=$.data.user.name FAILED - field is null Errors: ["Cannot return null for non-nullable field User.name"] Results: 2 passed, 1 failed (3 total) Duration: 1.2s ``` ### HTML Report The HTML report includes: * Executive summary card with pass/fail/total/skip counts * Per-test result cards with color-coded status badges * Request/response detail panels (expandable) * Latency histogram with p50/p90/p99 annotations * Timeline chart of test execution order * Failed assertion details with expected vs actual comparison * Environment variables and configuration used ### JSON Export ```json { "suite": "User API Regression", "environment": "staging", "timestamp": "2026-07-06T16:00:00Z", "summary": { "total": 3, "passed": 2, "failed": 1, "skipped": 0, "duration_ms": 1200 }, "tests": [ { "name": "List Users", "passed": true, "method": "GET", "path": "/users", "status_code": 200, "duration_ms": 142, "assertions": [ {"type": "status", "expected": 200, "actual": 200, "passed": true} ], "body": "[...]" } ] } ```

Why This Beats Prompting It Yourself

Dimension Prompting It Yourself API Tester Pro --- --- --- Protocol coverage REST only (curl) REST + GraphQL + WebSocket + gRPC + SOAP + SSE Assertions Manual grep/jq 20+ assertion types with structured evaluation Reporting Terminal echo only HTML + JSON + CSV + JUnit XML Security scanning None OWASP API Top 10 automated checks Performance testing Hand-rolled loops Concurrency-controlled benchmarks with percentiles Environment mgmt Manual variable swap YAML env profiles with variable resolution Schema validation Manual comparison OpenAPI 3.x schema validation Reusability One-off commands Suite files with dependencies and setup/teardown CI/CD integration Custom wrappers Native JUnit XML export

Use Cases

• CI/CD Pipeline Gate — Run API test suites as part of your deployment pipeline. Export JUnit XML for integration with Jenkins, GitLab CI, GitHub Actions. Fail the pipeline if any assertion fails.
• Pre-Deployment Smoke Test — After deploying to staging, run a targeted smoke test suite against critical endpoints (auth, checkout, search). Validate that the new build didn't break core flows.
• API Regression Suite — Maintain a comprehensive test suite that runs nightly. Track pass/fail trends over time. Get alerted when a previously passing test starts failing.
• Security Audit — Before releasing a new API endpoint, run the security scanner to check for OWASP Top 10 vulnerabilities. Get a structured report with severity levels and remediation steps.
• Performance Benchmarking — When making infrastructure changes (new database, CDN, caching layer), run benchmarks before and after. Compare p50/p90/p99 latency and throughput to validate improvements.