Schema and contract validation
Whether responses genuinely match the OpenAPI or schema definition.
API testing
We test the contract behind the interface: the right response, the right error, the right limit.
We validate endpoints against the schema, check whether error codes actually mean something, and push boundary values and concurrency cases. We can work from your Postman collection or build our own.
From the checklist
35 check items
Error code consistency
Whether 400 and 500 land in the right places and the error body is usable.
Rate limits and concurrency
Parallel requests to one resource, retries and race conditions.
Authentication flows
Token refresh, expiry and permission scope.
How we run it
- We take your schema or Postman collection and build an endpoint inventory.
- Each endpoint is exercised separately on the happy path, the error path and the boundaries.
- We push the authentication flows: token refresh, expiry and permission scope.
- Concurrency and retry scenarios are run with parallel requests.
What you get
- A schema conformance report per endpoint
- An error code map: what is returned in each case and what should be
- A Newman/k6 collection you can re-run yourself
Out of scope
- API design and writing documentation are out of scope.
- Third-party services are not tested themselves — only your integration with them is.
What this typically turns up
- Two parallel requests create the same order twice
- An invalid date format returns 500 where it should return 400
- An expired token is still accepted on some endpoints
Questions about this service
What if we have no schema?
That works. We build the inventory from a collection or from traffic; contract validation, however, needs a schema to exist.
Will rate limit testing affect production?
We work in a test environment. If production is unavoidable, rate limit and concurrency tests are left out of scope.
Do you support GraphQL?
Yes. Query depth, field-level permissions and N+1 behaviour are checked separately for GraphQL.
Included in
ReleaseWhole product, 3 platforms, pre-launchFleetRegression every release, monthlyEnterpriseRegulated sectors, custom SLA
Other services
Functional testingDo the critical flows work end to endRegression testingDid the new release break the old oneCompatibility matrixReal device and browser matrixPerformance & loadLoad speed and behaviour under loadSecurity reviewApplication review on the OWASP Top 10Payment testingPayments, refunds and subscriptions with real cardsAccessibilityWCAG 2.2 AA and screen readersUsability reviewFlows that work but wear people downLocalization testingCountry by country, with native speakers
Don't test the next release alongside your users.
Sign up in the panel, pick what you want tested, pay. The first findings start landing in the same panel within hours.