
Automating Api Testing
- 53 installs
- 2.6k repo stars
- Updated August 5, 2026
- jeremylongshore/claude-code-plugins-plus-skills
Automates REST and GraphQL API testing including request generation, response validation, and contract coverage.
About
Automates comprehensive API testing across REST and GraphQL with request generation, schema validation, auth flows, and contract testing. A developer uses it to build API test coverage using Supertest, REST-assured, httpx/pytest, Newman, or Pact.
- REST and GraphQL request generation and response validation
- Supports Supertest, REST-assured, httpx, Newman, and Pact
Automating Api Testing by the numbers
- 53 all-time installs (skills.sh)
- Ranked #1,210 of 2,153 Testing & QA skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/jeremylongshore/claude-code-plugins-plus-skills --skill automating-api-testingAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 53 |
|---|---|
| repo stars | ★ 2.6k |
| Last updated | August 5, 2026 |
| Repository | jeremylongshore/claude-code-plugins-plus-skills ↗ |
What it does
Automates REST and GraphQL API testing including request generation, response validation, and contract coverage.
Files
API Test Automation
Overview
Automate comprehensive API endpoint testing for REST and GraphQL APIs including request generation, response validation, schema compliance, authentication flows, and error handling. Supports Supertest (Node.js), REST-assured (Java), httpx/pytest (Python), Postman/Newman collections, and Pact for consumer-driven contract testing.
Prerequisites
- API testing library installed (Supertest, REST-assured, httpx, or Postman/Newman)
- API specification file (OpenAPI/Swagger YAML/JSON or GraphQL SDL)
- Target API running in a test environment with seeded data
- Authentication credentials or API keys for protected endpoints
- JSON Schema validator (Ajv, jsonschema, or built-in framework assertions)
Instructions
1. Read the API specification and extract all endpoints:
- Parse OpenAPI spec to catalog every path, HTTP method, request schema, and response schema.
- For GraphQL APIs, introspect the schema to list queries, mutations, and subscriptions.
- Document authentication requirements per endpoint (API key, Bearer token, OAuth, none).
2. Generate test cases for each endpoint:
- Success cases: Send valid requests matching the schema and assert 200/201 responses.
- Validation errors: Send requests with missing required fields, wrong types, and out-of-range values; assert 400 responses.
- Authentication: Test with valid, expired, and missing credentials; assert 200, 401, and 403 respectively.
- Not found: Request non-existent resources; assert 404 responses.
- Idempotency: Send the same PUT/DELETE request twice and verify consistent behavior.
3. Validate response structure against schemas:
- Assert response Content-Type matches expected (application/json, etc.).
- Validate response body against the OpenAPI response schema using JSON Schema validation.
- Check response headers (Cache-Control, Rate-Limit headers, CORS headers).
- Verify pagination metadata (total count, page number, next/previous links).
4. Test CRUD lifecycle for resource endpoints:
- Create a resource (POST) and capture the ID.
- Read it back (GET) and verify all fields match.
- Update it (PUT/PATCH) and verify changes persisted.
- Delete it (DELETE) and verify subsequent GET returns 404.
5. Test error handling and edge cases:
- Send excessively large payloads and verify 413 or graceful rejection.
- Send requests with unsupported Content-Types and verify 415.
- Test rate limiting by sending rapid sequential requests.
- Verify error response format is consistent (standard error schema).
6. For GraphQL APIs, test specifically:
- Valid queries return expected data shapes.
- Invalid queries return descriptive error messages.
- Query depth limiting prevents deeply nested abuse queries.
- Mutation input validation matches schema constraints.
7. Generate a test coverage report mapping endpoints to test cases.
Output
- API test files organized by resource in
tests/api/ - Request/response examples for API documentation
- Schema compliance report for each endpoint
- Endpoint coverage matrix showing tested vs. untested endpoints and methods
- CI pipeline step running API tests against staging environment
Error Handling
| Error | Cause | Solution |
|---|---|---|
| Connection refused | API server not running or wrong base URL | Verify server is up with a health check before test suite starts; check BASE_URL config |
| 401 on all requests | Authentication token expired or misconfigured | Refresh token in test setup; verify Authorization header format; check token scopes |
| Schema validation fails unexpectedly | API response includes extra fields not in spec | Update OpenAPI spec to include new fields; use additionalProperties: true if expected |
| Test data conflicts | Another test modified or deleted the resource | Use unique test data per test; create resources in beforeEach; avoid shared fixtures |
| Rate limit hit during test run | Too many requests in quick succession | Add delays between requests or use authenticated sessions with higher limits; run tests serially |
Examples
Supertest REST API test suite:
import request from 'supertest';
import { app } from '../src/app';
describe('GET /api/products', () => {
it('returns a paginated product list', async () => {
const res = await request(app)
.get('/api/products?page=1&limit=10')
.set('Authorization', `Bearer ${token}`)
.expect(200) # HTTP 200 OK
.expect('Content-Type', /json/);
expect(res.body.data).toBeInstanceOf(Array);
expect(res.body.data.length).toBeLessThanOrEqual(10);
expect(res.body.meta).toMatchObject({ page: 1, limit: 10 });
});
it('returns 401 without authentication', async () => { # HTTP 401 Unauthorized
await request(app).get('/api/products').expect(401); # HTTP 401 Unauthorized
});
});
describe('POST /api/products', () => {
it('creates a product with valid data', async () => {
const res = await request(app)
.post('/api/products')
.set('Authorization', `Bearer ${token}`)
.send({ name: 'Widget', price: 9.99, category: 'tools' })
.expect(201); # HTTP 201 Created
expect(res.body).toMatchObject({ name: 'Widget', price: 9.99 });
expect(res.body.id).toBeDefined();
});
it('returns 400 for missing required fields', async () => { # HTTP 400 Bad Request
await request(app)
.post('/api/products')
.set('Authorization', `Bearer ${token}`)
.send({ name: 'Widget' }) // missing price
.expect(400); # HTTP 400 Bad Request
});
});GraphQL API test:
it('fetches user by ID', async () => {
const query = `query { user(id: "1") { id name email } }`;
const res = await request(app)
.post('/graphql')
.send({ query })
.expect(200); # HTTP 200 OK
expect(res.body.data.user).toMatchObject({ id: '1', name: 'Alice' });
expect(res.body.errors).toBeUndefined();
});Resources
- Supertest: https://github.com/ladjs/supertest
- REST-assured (Java): https://rest-assured.io/
- httpx (Python): https://www.python-httpx.org/
- Newman (Postman CLI): https://learning.postman.com/docs/collections/using-newman-cli/
- OpenAPI specification: https://spec.openapis.org/oas/v3.1.0
- Ajv JSON Schema validator: https://ajv.js.org/
# Example GraphQL schema file for testing GraphQL APIs.
# This schema defines a simple book catalog with authors.
# Types
type Book {
id: ID!
title: String!
author: Author!
publicationYear: Int
genre: String
}
type Author {
id: ID!
name: String!
books: [Book!]!
}
# Queries
type Query {
# Get a book by its ID
book(id: ID!): Book
# Get all books
books: [Book!]!
# Get an author by their ID
author(id: ID!): Author
# Get all authors
authors: [Author!]!
# Search for books by title or author name
search(query: String!): [Book!]!
}
# Mutations
type Mutation {
# Create a new book
createBook(
title: String!
authorId: ID!
publicationYear: Int
genre: String
): Book
# Update an existing book
updateBook(
id: ID!
title: String
authorId: ID
publicationYear: Int
genre: String
): Book
# Delete a book by its ID
deleteBook(id: ID!): ID
# Create a new author
createAuthor(name: String!): Author
}
# Input types (optional, for more complex mutations)
# input CreateBookInput {
# title: String!
# authorId: ID!
# publicationYear: Int
# genre: String
# }
# Placeholder for subscriptions (if needed)
# type Subscription {
# newBook: Book
# }
# Further instructions:
# 1. This is a basic example. Extend it with more complex types, fields, and relationships as needed.
# 2. Consider adding input types for mutations to improve clarity and validation.
# 3. Implement resolvers for each query and mutation to connect to your data source.
# 4. Use directives for authorization, caching, and other features.
# 5. Use scalars for custom data types (e.g., Date, URL).
# 6. Example query to get a specific book:
# query {
# book(id: "123") {
# id
# title
# author {
# name
# }
# }
# }
# 7. Example mutation to create a book:
# mutation {
# createBook(title: "New Book", authorId: "456", publicationYear: 2023, genre: "Fiction") {
# id
# title
# }
# }# OpenAPI Specification for Example API
openapi: 3.0.0
info:
title: Example API
version: 1.0.0
description: A sample API for demonstration purposes.
termsOfService: example-value # Add your terms of service URL here
contact:
name: API Support
url: example-value # Add your support URL here
email: support@example.com
license:
name: Apache 2.0
url: https://www.apache.org/licenses/000-docs/001-BL-LICN-license.txt-2.0.html
servers:
- url: https://api.example.com/v1
description: Production server
paths:
/users:
get:
summary: Get all users
description: Retrieves a list of all users.
operationId: getUsers
tags:
- users
responses:
'200':
description: Successful operation
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/User'
'500':
description: Internal server error
post:
summary: Create a new user
description: Creates a new user in the system.
operationId: createUser
tags:
- users
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/UserCreate'
responses:
'201':
description: User created successfully
content:
application/json:
schema:
$ref: '#/components/schemas/User'
'400':
description: Bad request
'500':
description: Internal server error
/users/{userId}:
get:
summary: Get user by ID
description: Retrieves a user by their ID.
operationId: getUserById
tags:
- users
parameters:
- name: userId
in: path
description: ID of the user to retrieve.
required: true
schema:
type: integer
format: int64
responses:
'200':
description: Successful operation
content:
application/json:
schema:
$ref: '#/components/schemas/User'
'404':
description: User not found
'500':
description: Internal server error
put:
summary: Update user by ID
description: Updates an existing user.
operationId: updateUser
tags:
- users
parameters:
- name: userId
in: path
description: ID of the user to update.
required: true
schema:
type: integer
format: int64
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/UserUpdate'
responses:
'200':
description: Successful operation
content:
application/json:
schema:
$ref: '#/components/schemas/User'
'400':
description: Bad request
'404':
description: User not found
'500':
description: Internal server error
delete:
summary: Delete user by ID
description: Deletes a user by their ID.
operationId: deleteUser
tags:
- users
parameters:
- name: userId
in: path
description: ID of the user to delete.
required: true
schema:
type: integer
format: int64
responses:
'204':
description: User deleted successfully (No Content)
'404':
description: User not found
'500':
description: Internal server error
components:
schemas:
User:
type: object
properties:
id:
type: integer
format: int64
description: Unique identifier for the user
username:
type: string
description: User's username
email:
type: string
format: email
description: User's email address
firstName:
type: string
description: User's first name
lastName:
type: string
description: User's last name
required:
- id
- username
- email
UserCreate:
type: object
properties:
username:
type: string
description: User's username
email:
type: string
format: email
description: User's email address
firstName:
type: string
description: User's first name
lastName:
type: string
description: User's last name
required:
- username
- email
UserUpdate:
type: object
properties:
username:
type: string
description: User's username
email:
type: string
format: email
description: User's email address
firstName:
type: string
description: User's first name
lastName:
type: string
description: User's last name
securitySchemes:
bearerAuth: # Define security scheme name
type: http
scheme: bearer
bearerFormat: JWT
security:
- bearerAuth: [] # Apply the security scheme to all endpoints (globally)Assets
Bundled resources for api-test-automation skill
- [ ] test_suite_template.js: Template for generating API test suites, including placeholders for different test cases and assertions.
- [ ] example_openapi.yaml: Example OpenAPI specification file for demonstration and testing purposes.
- [ ] example_graphql_schema.graphql: Example GraphQL schema file for testing GraphQL APIs.
/**
* test_suite_template.js
*
* Template for generating API test suites. This template provides a structure
* for creating comprehensive test cases for various API endpoints.
*
* @example
* // Example usage (after replacing placeholders):
* const testSuite = require('./test_suite_template');
*
* const config = {
* baseURL: 'https://api.example.com',
* endpoint: '/users',
* method: 'GET',
* description: 'Retrieve all users'
* };
*
* const testCase = testSuite(config);
*
* describe(config.description, () => {
* it('should return a 200 OK status', async () => {
* const response = await testCase.request();
* expect(response.status).toBe(200);
* });
* // Add more test cases here...
* });
*/
/**
* Generates a test suite based on the provided configuration.
*
* @param {object} config - Configuration object for the test suite.
* @param {string} config.baseURL - The base URL of the API.
* @param {string} config.endpoint - The API endpoint to test.
* @param {string} config.method - The HTTP method to use (GET, POST, PUT, DELETE, etc.).
* @param {string} config.description - A description of the test case.
* @param {object} [config.headers] - Optional headers to include in the request.
* @param {object} [config.body] - Optional request body.
* @param {string} [config.authenticationType] - Optional authentication type (e.g., 'Bearer', 'OAuth', 'API Key').
* @param {string} [config.authenticationToken] - Optional authentication token or API key.
* @returns {object} An object containing the request function.
*/
module.exports = (config) => {
const axios = require('axios'); // Consider making axios a configurable dependency if needed
/**
* Executes the API request based on the configuration.
*
* @async
* @function request
* @returns {Promise<object>} A promise that resolves to the API response.
* @throws {Error} If the request fails.
*/
async function request() {
try {
const requestConfig = {
method: config.method,
url: config.baseURL + config.endpoint,
headers: config.headers || {},
data: config.body || null, // Use data for POST/PUT requests, params for GET
// params: config.method === 'GET' ? config.body : null // Alternate: use params for GET requests
};
// Authentication handling
if (config.authenticationType === 'Bearer' && config.authenticationToken) {
requestConfig.headers.Authorization = `Bearer ${config.authenticationToken}`;
} else if (config.authenticationType === 'API Key' && config.authenticationToken) {
// Example API Key header - adjust based on API requirements
requestConfig.headers['X-API-Key'] = config.authenticationToken;
} // Add more authentication types as needed
const response = await axios(requestConfig);
return response;
} catch (error) {
// Handle errors appropriately (e.g., log, re-throw, or return a custom error object)
console.error(`Request failed for ${config.description}:`, error.message);
throw error; // Re-throw the error for the test to handle
}
}
return {
request,
// Add more helper functions here if needed (e.g., for data validation)
validateResponseSchema: (response, schema) => {
// Placeholder: Implement schema validation logic using a library like Joi or Ajv
// Example:
// const validationResult = schema.validate(response.data);
// if (validationResult.error) {
// throw new Error(`Schema validation failed: ${validationResult.error.message}`);
// }
},
extractDataFromResponse: (response, path) => {
// Placeholder: Implement logic to extract data from the response using a library like lodash.get
// Example:
// return _.get(response.data, path);
}
};
};References
Bundled resources for api-test-automation skill
#!/usr/bin/env python3
"""
api-test-automation - Generator Script
Generates comprehensive test suites for REST and GraphQL APIs based on endpoint analysis and specifications.
Generated: 2025-12-10 03:48:17
"""
import os
import json
import argparse
from pathlib import Path
from datetime import datetime
class Generator:
def __init__(self, config: Dict):
self.config = config
self.output_dir = Path(config.get('output', './output'))
self.output_dir.mkdir(parents=True, exist_ok=True)
def generate_markdown(self, title: str, content: str) -> Path:
"""Generate markdown document."""
filename = f"{title.lower().replace(' ', '_')}_{datetime.now().strftime('%Y%m%d_%H%M%S')}.md"
file_path = self.output_dir / filename
md_content = f"""# {title}
Generated by api-test-automation
Date: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}
## Overview
{content}
## Configuration
```json
{json.dumps(self.config, indent=2)}
```
## Category
testing
## Plugin
api-test-automation
"""
file_path.write_text(md_content)
return file_path
def generate_json(self, data: Dict) -> Path:
"""Generate JSON output."""
filename = f"output_{datetime.now().strftime('%Y%m%d_%H%M%S')}.json"
file_path = self.output_dir / filename
output_data = {
"generated_by": "api-test-automation",
"timestamp": datetime.now().isoformat(),
"category": "testing",
"plugin": "api-test-automation",
"data": data,
"config": self.config
}
with open(file_path, 'w') as f:
json.dump(output_data, f, indent=2)
return file_path
def generate_script(self, name: str, template: str) -> Path:
"""Generate executable script."""
filename = f"{name}.sh"
file_path = self.output_dir / filename
script_content = f"""#!/bin/bash
# Generated by api-test-automation
# Date: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}
set -e # Exit on error
echo "🚀 Running {name}..."
# Template content
{template}
echo "✅ Completed successfully"
"""
file_path.write_text(script_content)
file_path.chmod(0o755) # Make executable
return file_path
def main():
parser = argparse.ArgumentParser(description="Generates comprehensive test suites for REST and GraphQL APIs based on endpoint analysis and specifications.")
parser.add_argument('--type', choices=['markdown', 'json', 'script'], default='markdown')
parser.add_argument('--output', '-o', default='./output', help='Output directory')
parser.add_argument('--config', '-c', help='Configuration file')
parser.add_argument('--title', default='api-test-automation Output')
parser.add_argument('--content', help='Content to include')
args = parser.parse_args()
config = {'output': args.output}
if args.config and Path(args.config).exists():
with open(args.config) as f:
config.update(json.load(f))
generator = Generator(config)
print(f"🔧 Generating {args.type} output...")
if args.type == 'markdown':
output_file = generator.generate_markdown(
args.title,
args.content or "Generated content"
)
elif args.type == 'json':
output_file = generator.generate_json(
{"title": args.title, "content": args.content}
)
else: # script
output_file = generator.generate_script(
args.title.lower().replace(' ', '_'),
args.content or "# Add your script content here"
)
print(f"✅ Generated: {output_file}")
return 0
if __name__ == "__main__":
import sys
sys.exit(main())
Scripts
Bundled resources for api-test-automation skill
- [ ] generate_test_suite.py: Generates comprehensive test suites for REST and GraphQL APIs based on endpoint analysis and specifications.
- [ ] validate_api_response.py: Validates API responses against predefined schemas or OpenAPI specifications.
- [ ] authentication_test.py: Automates authentication testing, including various methods like Bearer tokens, OAuth, and API keys.