Skip to content
certyn logoCertyn
Start Free
RecipesDoc

Test Your API from Its OpenAPI Spec

Certyn reads your OpenAPI spec, sends real requests to staging, and files the places where the API breaks its contract.

For teams with a REST API and an OpenAPI (Swagger) spec, and no API tests yet.

Your setup

  • A REST API on staging, for example https://api.staging.example.com.
  • An OpenAPI spec at a URL, for example /openapi.json.
  • An API key, a bearer token, or a login for a test user.
  • You want contract bugs found, with the requests that prove them.

Say this to Certyn

Test our staging API against its OpenAPI spec at https://api.staging.example.com/openapi.json. Auth is a bearer token.

What Certyn does

  1. For an API-only service, sets the project type to api (app.project.update, you approve). The environment's URL is the API base URL.
  2. Opens the sign-in form. In an API project it asks how the API checks callers: API key (saved as API_KEY, with the header name), bearer token (API_TOKEN), username and password, or your own steps.
  3. Saves the spec URL as the variable OPENAPI_SPEC_URL, so later runs find it (you approve).
  4. Starts an API run with the spec (app.run.create type api, spec_url). Add a focus if you want one, like orders and payments only.
  5. In the run, Certyn reads the spec and starts with the riskiest endpoints: writes, login and access, money, personal data. It sends one valid request per endpoint, then checks status codes, content types, required fields, types, error shapes, unknown ids, pagination and calls without a token.
  6. It files each contract break as an issue, with the request and response as evidence. Secrets show as [REDACTED].

What you get

  • A run report and one issue per real problem, for example a 500 on bad input or another user's record returned.
  • If you ask: test cases for the API flows, with an exact Hurl block when you need fixed requests.
  • If you ask: the same check after each deploy.

Limits

  • An API run has about 18 minutes, so a large API is covered only in part. Run one area at a time with a focus, or ask for an explore run with more minutes (up to 240) and the spec URL in its goal.
  • Certyn prefers reads and makes only small writes on data it creates. Still, test staging, not production.
  • No load testing, fuzzing tools or Postman collections in an API run. Use the k6 or Newman recipes.
  • The spec and the API must be reachable from the Machine. For a private API, use a self-hosted runner.
PreviousTurn a Jira Story, a Spec or a PRD into Test Cases, Then Run ThemNextAccessibility Check of Your Key Pages