API Test Suite Builder

Scan API route definitions across frameworks (Next.js App Router, Express, FastAPI, Django REST, Go net/http), analyze request/response schemas, and generate comprehensive test suites covering authentication, authorization, input validation, error handling, pagination, file uploads, rate limiting, contract testing, and load testing. Outputs ready-to-run test files for Vitest+Supertest (Node), Pytest+httpx (Python), or k6 (load testing).

Core Capabilities

• Route detection & analysis — scan source files to extract endpoints, parse request/response schemas, detect auth middleware and authorization rules across Node, Python, and Go frameworks.
• Test matrix generation — auth (valid/invalid/expired tokens, wrong roles), input validation (missing/wrong-type/boundary/injection), error paths (400/401/403/404/409/422/429/500), pagination, file uploads, and rate limiting.
• Contract testing — OpenAPI-to-test generation, Pact consumer-driven contracts, schema snapshot testing for breaking-change detection.
• Load testing — k6 scripts with ramp-up patterns and SLA thresholds, latency percentile tracking (P50/P95/P99), concurrent user simulation.

When to Use

• New API added — generate a test scaffold before implementation (TDD).
• Legacy API with no tests — scan and generate baseline coverage.
• Pre-release — ensure all routes have at least smoke tests.
• API contract change — detect and test breaking changes.
• Security audit — generate adversarial input tests.
• Performance validation — create load-test baselines.

Clarify First

Before generating the suite, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Target framework — Vitest+Supertest, Pytest+httpx, or k6 (determines the emitted test-file format via --framework)
• Spec or routes source — an OpenAPI spec or the source files to scan (the input the generator parses)
• Test scope — auth, input validation, contract, load, or the full matrix (which test categories get generated)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Tools

References

Load the reference that matches the task — keep this file lean and pull detail on demand:

• references/route-detection-and-matrices.md — per-framework route-detection shell commands and the full auth / input-validation / pagination test matrices with worked TypeScript examples. Read when scanning a codebase or writing the core test cases.
• references/contract-and-load-testing.md — complete Pact consumer-driven contract test and k6 load-test scripts, plus the commands to run load tests locally, against staging, and in the cloud. Read when adding contract or performance tests.
• references/workflow-and-quality.md — the 9-step generation workflow, reusable test-helper patterns (auth, authed request, factories), common pitfalls, best practices, a troubleshooting table, and the success-criteria bar. Read before generating a suite and before shipping it.

Scope & Limitations

This skill covers:

• Generating test suites from route definitions for REST APIs across Node.js, Python, and Go frameworks
• Authentication, authorization, input validation, pagination, and error-path test generation
• Consumer-driven contract testing with Pact and schema snapshot validation
• Load and performance testing script generation with k6 and Artillery

This skill does NOT cover:

• GraphQL API testing (see engineering/api-design-reviewer for schema review patterns)
• End-to-end browser testing or UI interaction testing (see engineering/playwright-pro)
• Database migration testing or schema validation (see engineering/database-schema-designer)
• Security penetration testing beyond input sanitization checks (see engineering/skill-security-auditor)

Integration Points