Sign in Start testing
Softsurance/API testingPreview

Every endpoint, called on purpose.

Import an OpenAPI spec, choose which operations may be called, and assert on status, headers and response shape — with read-only requests as the default.

Start testing Read the docs

At a glance

InputOpenAPI 3.x spec
DefaultRead-only requests
AuthEncrypted, redacted
StatusPreview

API testing follows browser testing. The preview covers import, endpoint selection and assertions; mutating requests stay off unless you configure an isolated environment.

Request · read-onlyorders-api / staging
GET /v1/orders?limit=5 Authorization: Bearer •••••••• (redacted) Accept: application/json
  • PASSStatus is 200212 ms
  • PASSContent-Type is application/json—
  • PASSRequired field items[] present—
  • FAILitems[0].total — expected number, got stringschema
  • PASSNegative: missing token → 40188 ms

01 / Capabilities

What it checks11 items

What it checks.

Everything a run checks, and the evidence it keeps when something fails.

  • OpenAPI importPreview
  • Endpoint discovery from specPreview
  • Status code assertionsPreview
  • Header assertionsPreview
  • Response schema validationPreview
  • Required field checksPreview
  • Negative tests (auth, bad input)Preview
  • Redacted request/response evidencePreview
  • Scheduled API regression runsPreview
  • Mutating requests in sandboxRoadmap
  • Endpoint regression historyRoadmap

02 / How it works

Step by step5 steps

  1. Import the spec

    Upload or link an OpenAPI document. Softsurance lists every documented operation with its method, path and parameters.

  2. Choose what may be called

    Select the base URL and the operations that are permitted. GET, HEAD and OPTIONS are preferred; anything mutating is excluded by default.

  3. Configure authentication

    Add a token or key as an encrypted credential. It is injected at request time and redacted from every log and artifact.

  4. Define assertions

    Expected status, headers, schema conformance and specific field values. Negative tests check that bad requests are refused.

  5. Run and schedule

    Execute on demand or on a schedule, and see request and response evidence with secrets removed.

03 / Guardrails

Enforced by the backendNot optional

The limits come first.

These rules are enforced by the execution backend. The interface can’t switch them off, and neither can an AI.

G-01

Allowlisted paths

Requests outside the permitted base URL and operations are refused before they leave the worker.

G-02

No blanket execution

Importing a spec never runs every operation. Each one is selected deliberately.

G-03

Secrets stay secret

Bearer tokens, keys and cookies are redacted from logs, evidence and AI prompts.

G-04

Rate and time limits

Per-request timeouts and request budgets keep tests from loading your API.

04 / Questions

API testing3 entries
Q.01Will it call POST or DELETE endpoints?

Not by default. Mutating operations require explicit configuration and an isolated test environment.

Q.02Do I need a spec?

The preview is built around OpenAPI import. Manually defined endpoints are planned.

Q.03Where does my API token go?

It’s encrypted at rest, injected into requests inside the worker, and never returned by our API or shown in evidence.

Start

Your first runStaging URL required

Add a staging URL. Read your first real result today.

Start testing Read the docs