API Test Suite Builder

Tier: POWERFUL
Category: Engineering
Domain: Testing / API Quality

Overview

Scans API route definitions across frameworks (Next.js App Router, Express, FastAPI, Django REST) and
auto-generates comprehensive test suites covering auth, input validation, error codes, pagination, file
uploads, and rate limiting. Outputs ready-to-run test files for Vitest+Supertest (Node) or Pytest+httpx
(Python).

Core Capabilities

• - Route detection — scan source files to extract all API endpoints
• Auth coverage — valid/invalid/expired tokens, missing auth header
• Input validation — missing fields, wrong types, boundary values, injection attempts
• Error code matrix — 400/401/403/404/422/500 for each route
• Pagination — first/last/empty/oversized pages
• File uploads — valid, oversized, wrong MIME type, empty
• Rate limiting — burst detection, per-user vs global limits

When to Use

• - New API added — generate test scaffold before writing implementation (TDD)
• Legacy API with no tests — scan and generate baseline coverage
• API contract review — verify existing tests match current route definitions
• Pre-release regression check — ensure all routes have at least smoke tests
• Security audit prep — generate adversarial input tests

Route Detection

Next.js App Router

Express

FastAPI

Django REST Framework

# urlpatterns extraction
grep -rn "path\|re_path\|url(" . --include="*.py" | grep "urlpatterns" -A 50 | \
  grep -E "path\(['\"]" | grep -oE "['\"][^'\"]+['\"]" | head -40

# ViewSet router registration
grep -rn "router\.register\|DefaultRouter\|SimpleRouter" . --include="*.py"

Test Generation Patterns

Auth Test Matrix

For every authenticated endpoint, generate:

Input Validation Matrix

For every POST/PUT/PATCH endpoint with a request body:

Example Test Files

Generating Tests from Route Scan

When given a codebase, follow this process:

1. 1. Scan routes using the detection commands above
2. Read each route handler to understand:

1. 3. Generate test file per route group using the patterns above
2. Name tests descriptively: "returns 401 when token is expired" not INLINECODE2
3. Use factories/fixtures for test data — never hardcode IDs
4. Assert response shape, not just status code

Common Pitfalls

• - Testing only happy paths — 80% of bugs live in error paths; test those first
• Hardcoded test data IDs — use factories/fixtures; IDs change between environments
• Shared state between tests — always clean up in afterEach/afterAll
• Testing implementation, not behavior — test what the API returns, not how it does it
• Missing boundary tests — off-by-one errors are extremely common in pagination and limits
• Not testing token expiry — expired tokens behave differently from invalid ones
• Ignoring Content-Type — test that API rejects wrong content types (xml when json expected)

Best Practices

1. 1. One describe block per endpoint — keeps failures isolated and readable
2. Seed minimal data — don't load the entire DB; create only what the test needs
3. Use beforeAll for shared setup, afterAll for cleanup — not beforeEach for expensive ops
4. Assert specific error messages/fields, not just status codes
5. Test that sensitive fields (password, secret) are never in responses
6. For auth tests, always test the "missing header" case separately from "invalid token"
7. Add rate limit tests last — they can interfere with other test suites if run in parallel