api-testing
OpenAPI-driven API testing with Schemathesis for schema validation, fuzzing, and CI reporting.
Overview
Schemathesis reads OpenAPI schemas (local or remote) and generates tests that validate API behavior. It supports authentication, different phases (examples and fuzzing), concurrency, and test reports.
When to Use
- You already have OpenAPI specs and want coverage
- You need fuzzing or schema-driven tests
- You want CI-friendly reports (JUnit)
When Not to Use
- No schema exists (generate one first)
- You need UI/browser tests
Quick Start
uv pip install schemathesis
schemathesis run https://api.example.com/openapi.json
schemathesis run ./openapi.yaml --url https://api.example.comCore Patterns
- Schema-first: keep OpenAPI synced to code.
- Auth headers: pass tokens for protected endpoints.
- Phases: use
--phases examples,fuzzing. - Concurrency: scale with
--workers. - Rate limits: throttle with config
rate-limit. - CI reports:
--report junit --report-dir./reports. - Reproducible runs: set
--seed.
CLI Examples
# Auth header
schemathesis run https://api.example.com/openapi.json \
--header "Authorization: Bearer $TOKEN"
# Examples + fuzzing
schemathesis run ./openapi.yaml --url https://api.example.com \
--phases examples,fuzzing
# Concurrency
schemathesis run ./openapi.yaml --url https://api.example.com --workers 4
# JUnit report
schemathesis run ./openapi.yaml --url https://api.example.com \
--report junit --report-dir ./reportsConfiguration
Use config to rate-limit tests:
rate-limit = "100/m"Troubleshooting
- Schema mismatch: regenerate OpenAPI from code
- Auth failures: confirm headers or basic auth
- Flaky endpoints: isolate destructive endpoints
- Slow runs: limit phases or reduce workers