API Testing: Move from an endpoint list to authorization, contracts, exceptions, and idempotency validation
An HTTP 200 does not prove an API contract is safe. Field semantics, authorization, error paths, and idempotency can still break consumers after release.
The API Testing Skill treats requests, responses, negative paths, and data ownership as one coherent contract—not a pile of status-code checks.
This guide uses reproducible scenarios to show how to apply it: define the risk and evidence first, then organize the checks and results into a defensible next step.
Awesome QA Skills organizes Skills by language and testing stage. The series overview covers repository structure and shared installation options; this guide stays with API Testing.
Read the source Skill first
The main prompt covers Quality Bar, Workflow, Core Constraints, Progressive Disclosure, Pre-delivery Checklist. Those headings are navigation; the project artifacts still provide the facts.
The source directory contains 2 references, 17 script entries. Start with API Testing supporting references, Template conversion script.
Work through one concrete task
Design order API tests for authentication, contracts, idempotency, errors, and state transitions
Start with this compact input set.
Sources: current requirements, relevant pages or interfaces, known defects
Scope: journeys affected by this change
Unknowns: environment, accounts, data preparation
Expected output: risk order, coverage list, open questionsThis output fragment demonstrates the contract. It is not an execution result.
| Priority | Test point | Basis | Status |
|---|---|---|---|
| P0 | Core business journey | Acceptance criterion AC-01 | Not run |
| P1 | Error and recovery | Historical defect BUG-17 | Data missing |
| P1 | Boundary and state changes | Business rule BR-03 | Needs confirmation |
Do not write “passed” during static design. Runtime evidence comes later.
Move from coverage ideas to a decision
The task is Design order API tests for authentication, contracts, idempotency, errors, and state transitions. Split by risk before deciding how many cases to write.
| Risk question | Test design | Evidence |
|---|---|---|
| Could the main journey block a transaction | End-to-end path with state assertions | Run record, order state, build ID |
| Could retry create duplicate data | Repeat submission and idempotency check | Request ID and data query |
| Can a user recover after failure | Timeout, refresh, and re-entry | UI state, logs, recovery result |
Grow the table after Quality Bar and Workflow has been checked against the change. For each test point, ask which requirement or risk supports it, which environment and data it needs, and what remains after failure. An unanswered item is still an idea, not an execution handoff.
A prompt you can adapt
Replace the bracketed fields with project facts. Specific material leaves less room for guessing.
Use the api-testing Skill.
Task: Design order API tests for authentication, contracts, idempotency, errors, and state transitions
Version and environment: [requirement / build / environment]
Inputs: [file paths or links]
Scope: [included and excluded journeys]
Constraints: [accounts, data, time, compliance]
Order coverage by business risk and distinguish design from execution status. Give each test point a basis, data need, and expected evidence.
Finish with open questions. Do not invent missing facts.Use the first pass to inspect structure and gaps. Supply missing material before asking for the handoff-ready artifact.
Advanced use, from one call to a maintained flow
Save the result of Design order API tests for authentication, contracts, idempotency, errors, and state transitions as a baseline. After requirement or code changes, perform impact analysis and rerun affected journeys plus the fixed gate set.
A three-Skill chain
requirements-analysis → api-testing → test-reporting
| Handoff | Payload | Receiver check |
|---|---|---|
| Upstream to api-testing | Source versions, scope, risks, open questions | API Testing staleness and conflicts |
| api-testing to downstream | Primary artifact, evidence index, unfinished work | API Testing executability and owners |
| Feedback to api-testing | Runs, defects, new risks | API Testing baseline and regression update |
Do not paste three complete outputs into one large prompt. Give API Testing a structured summary and accessible source artifacts. It saves context and makes defects traceable.
Team gates
| Gate | Check | Failure action |
|---|---|---|
| api-testing input | Version, environment, owner, accessible sources | Stop API Testing and list gaps |
| api-testing artifact | Material claims carry basis and status | Return API Testing for evidence |
| api-testing execution | Command, exit status, report are reproducible | Classify infrastructure or test failure |
| api-testing decision | Residual risks have accepter and date | Do not enter the next stage |
Review API Testing adoption, human edit rate, unsupported claims, and failure-to-diagnosis time each sprint. Record a baseline for several cycles before setting targets.
What I would inspect during use
- Scope points to a real business journey instead of turning API Testing into an encyclopedia.
- Quality Bar is grounded in requirements, pages, interfaces, or defects.
- Happy paths, exceptions, boundaries, and recovery are ordered by risk.
- Status distinguishes designed, not run, passed, and failed.
Install and invoke
Install the individual Skill. The series overview carries the longer installation explanation.
npx skills add https://github.com/naodeng/awesome-qa-skills/tree/main/skills/en/testing-types/api-testing -gInvoke it with “Use the api-testing Skill,” then attach the real artifacts.
Two practical questions
Can I use API Testing with incomplete material?
Yes, but the result should degrade to known facts, assumptions, and open questions. Missing environments or data cannot support an execution claim.
How do I know whether Workflow is sufficient?
Trace it back to requirements and risks. A handoff-ready result explains coverage, omissions, and the next action.
When is human review mandatory?
Require an accountable person for scope trade-offs, risk acceptance, release decisions, and source conflicts.
What should be archived?
Keep the input version, Skill output, human edits, and final evidence so the conclusion can be reconstructed.
Run API Testing against one real artifact and keep the input, output, and review notes. The fragments here establish structure; project evidence must still come from the project.
References
- Awesome QA Skills project:https://github.com/naodeng/awesome-qa-skills
- Awesome QA Skills series overview:https://inaodeng.com/en/blog/ai-testing/introduction_of_awesome_qa_skills/
- API Testing supporting references:https://github.com/naodeng/awesome-qa-skills/tree/main/skills/en/testing-types/api-testing/references/local
- API Testing helper script: batch_convert_templates.py:https://github.com/naodeng/awesome-qa-skills/tree/main/skills/en/testing-types/api-testing/scripts/batch_convert_templates.py
- Awesome QA Skills: API Testing Skill source:https://github.com/naodeng/awesome-qa-skills/tree/main/skills/en/testing-types/api-testing
- API Testing Skill details:https://inaodeng.com/en/qaskills/api-testing/