API Test Suite Builder

This skill automatically generates comprehensive test suites for APIs across various frameworks like Next.

Install

npx promptshop add api-test-suite-builder

Details

What This Skill Does

This skill automatically generates comprehensive test suites for APIs across various frameworks like Next.js, Express, Fast API, and Django REST. It covers aspects like authentication, input validation, error codes, pagination, file uploads, and rate limiting, outputting ready-to-run test files.

When to Use

Adding a new API and generating a test scaffold. Scanning a legacy API to generate baseline coverage. Reviewing API contracts to verify existing tests. Performing pre-release regression checks. Preparing for security audits with adversarial input tests.

Key Features

Detects API routes across multiple frameworks. Generates tests for authentication coverage. Creates tests for input validation and error handling. Covers pagination and file upload scenarios. Includes tests for rate limiting functionality.

Manual Installation

API Test Suite Builder

Tier: POWERFUL Category: Engineering Domain: Testing / API Quality

Overview

Scans API route definitions across frameworks (Next.js App Router, Express, Fast API, Django REST) and auto-generates comprehensive test suites covering auth, input validation, error codes, pagination, file uploads, and rate limiting. Outputs ready-to-run test files for Vitest+Supertest (Node) or Pytest+httpx (Python).

Core Capabilities

Route detection — scan source files to extract all API endpoints Auth coverage — valid/invalid/expired tokens, missing auth header Input validation — missing fields, wrong types, boundary values, injection attempts Error code matrix — 400/401/403/404/422/500 for each route Pagination — first/last/empty/oversized pages File uploads — valid, oversized, wrong MIME type, empty Rate limiting — burst detection, per-user vs global limits

New API added — generate test scaffold before writing implementation (TDD) Legacy API with no tests — scan and generate baseline coverage API contract review — verify existing tests match current route definitions Pre-release regression check — ensure all routes have at least smoke tests Security audit prep — generate adversarial input tests

Route Detection

Next.js App Router

Find all route handlers

find ./app/api -name "route.ts" -o -name "route.js" | sort

Extract HTTP methods from each route file grep -rn "export async function|export function" app/api/**/route.ts |
grep -o E "(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)" | sort -u

Full route map find ./app/api -name "route.ts" | while read f; do route=$(echo $f | sed 's|./app||' | sed 's|/route.ts||') methods=$(grep -o E "export (async )?function (GET|POST|PUT|PATCH|DELETE)" "$f" |
grep -o E "(GET|POST|PUT|PATCH|DELETE)") echo "$methods $route" done

Express

Find all router files

Fast API

Find all route decorators

Django REST Framework

urlpatterns extraction

View Set router registration grep -rn "router.register|Default Router|Simple Router" . --include="*.py"

Test Generation Patterns

Auth Test Matrix

For every authenticated endpoint, generate:

Test Case	Expected Status
No Authorization header	401
Invalid token format	401
Valid token, wrong user role	403
Expired JWT token	401
Valid token, correct role	2xx
Token from deleted user	401

Input Validation Matrix

For every POST/PUT/PATCH endpoint with a request body:

| Empty body {} | 400 or 422 | | Missing required fields (one at a time) | 400 or 422 | | Wrong type (string where int expected) | 400 or 422 | | Boundary: value at min-1 | 400 or 422 | | Boundary: value at min | 2xx | | Boundary: value at max | 2xx | | Boundary: value at max+1 | 400 or 422 | | SQL injection in string field | 400 or 200 (sanitized) | | XSS payload in string field | 400 or 200 (sanitized) | | Null values for required fields | 400 or 422 |

Example Test Files

→ See references/example-test-files.md for details

Generating Tests from Route Scan

When given a codebase, follow this process:

Scan routes using the detection commands above Read each route handler to understand:

Expected request body schema
Auth requirements (middleware, decorators)
Return types and status codes
Business rules (ownership, role checks) Generate test file per route group using the patterns above Name tests descriptively: "returns 401 when token is expired" not "auth test 3" Use factories/fixtures for test data — never hardcode IDs Assert response shape, not just status code

Common Pitfalls

Testing only happy paths — 80% of bugs live in error paths; test those first Hardcoded test data IDs — use factories/fixtures; IDs change between environments Shared state between tests — always clean up in after Each/after All Testing implementation, not behavior — test what the API returns, not how it does it Missing boundary tests — off-by-one errors are extremely common in pagination and limits Not testing token expiry — expired tokens behave differently from invalid ones Ignoring Content-Type — test that API rejects wrong content types (xml when json expected)

Best Practices

One describe block per endpoint — keeps failures isolated and readable Seed minimal data — don't load the entire DB; create only what the test needs Use before All for shared setup, after All for cleanup — not before Each for expensive ops Assert specific error messages/fields, not just status codes Test that sensitive fields (password, secret) are never in responses For auth tests, always test the "missing header" case separately from "invalid token" Add rate limit tests last — they can interfere with other test suites if run in parallel API Test Suite Builder