api-testing

Validates REST API endpoints against HTTP status codes, payload contracts, and authentication rules.

Updated Sep 1, 2026
One-click install
npx skills add https://github.com/sshekhar-04/SIH_PS_26151 --skill api-testing-sshekhar-04
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: api-testing
Source: https://github.com/sshekhar-04/SIH_PS_26151/tree/main/.agents/Skills/api-testing
Command: npx skills add https://github.com/sshekhar-04/SIH_PS_26151 --skill api-testing-sshekhar-04

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Testing REST APIs manually is error-prone and inconsistent, often missing edge cases like missing fields, boundary values, or incorrect status codes. This Skill provides a structured methodology for verifying endpoint contracts, authentication behavior, and error responses. ## Core Features & Use Cases - HTTP Status Code Verification: Maps scenarios like resource creation, validation errors, and auth failures to the correct status codes (201, 400, 401, 403, 404, 409). - Standardized Testing Checklist: Covers happy paths, missing required fields, boundary values, authorization checks, and idempotency for GET, PUT, and DELETE. - cURL Request Generation: Produces ready-to-run curl commands with JSON payloads and Bearer token headers. - Use Case: When building a user registration endpoint, use this Skill to verify that duplicate emails return 409 Conflict, missing fields return 400 with structured error messages, and unauthenticated calls return 401. ## Quick Start Test my POST /api/v1/users endpoint and verify it returns the correct status codes for valid input, missing fields, and unauthenticated requests.

Frequently Asked Questions about api-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test REST API endpoints with curl?

Use curl with the -X flag for the HTTP method, -H for headers like Content-Type and Authorization, and -d for the JSON payload. For example, POST to an endpoint with a Bearer token and JSON body, then verify the returned status code and response structure.

What HTTP status code should a POST request return?

A successful resource creation should return 201 Created, preferably with a Location header or the created object in the body. Return 200 OK only when returning an existing or updated resource, and 202 Accepted for asynchronous processing.

How do I test API authentication and authorization?

Call the endpoint without an Authorization header and expect 401 Unauthorized for missing or invalid tokens. Then call with a valid token lacking the required role and expect 403 Forbidden to confirm permission enforcement.

What is the difference between 400 and 409 status codes?

400 Bad Request indicates malformed JSON or failed field validations like missing required fields. 409 Conflict indicates a business rule violation such as a unique constraint failure, for example registering with a duplicate email address.

Why should GET, PUT, and DELETE requests be idempotent?

Idempotency ensures that multiple identical requests produce the same server state as a single request, making retries safe after network failures. Test this by sending the same request twice and verifying the resource state and response remain consistent.