api-deep-analyzer

API Deep Analyzer

Purpose

Given an API endpoint, produce complete, structured test coverage ready to execute. No manual brainstorming. No forgotten edge cases. Consistent quality every time.

---

Input Accepted

• Endpoint: method + path (e.g. POST /orders/checkout)
• Headers, body schema, query params
• Swagger/OpenAPI snippet or full spec
• Plain business description of the endpoint
• Existing collection to extend

---

Analysis Process

Step 1 — API Profile

Extract and document:

Method        : POST / GET / PUT / DELETE / PATCH
Path          : /resource/action
Auth          : Bearer / API Key / None / Other
Headers       : Content-Type, Authorization, custom headers
Body Fields   : name, type, required/optional, constraints
Query Params  : name, type, description
Business Goal : what this endpoint does in the system
Dependencies  : which services / DB / events are involved
Sensitive Data: financial? PII? session? audit required?

Step 2 — Risk Assessment

Tag every test area:

[CRITICAL]  → auth, financial data, data integrity, security breach
[HIGH]      → business rules, state changes, data persistence
[MEDIUM]    → error messages, response format, performance
[LOW]       → optional fields, cosmetic, non-critical behavior

Step 3 — Test Generation

✅ Happy Path

• Standard success with valid, complete data
• Success with minimum required fields only
• Success with boundary values (min, max)
• Success with different valid user roles (if applicable)

❌ Negative Cases

• Each required field missing independently
• Invalid field type (string where number expected, etc.)
• Invalid value (negative amount, future date where past expected, etc.)
• No authentication token → 401
• Invalid / expired token → 401
• Wrong role → 403
• Duplicate / idempotency request

⚠️ Edge Cases

• Null vs empty string vs missing field (3 distinct cases)
• Special characters in string fields
• Whitespace-only string values
• Maximum payload size exceeded
• Concurrent requests (race condition)