# API Contract Mutation Tester Mutate OpenAPI request fields into semantically risky variants and optionally send them to a real backend to check defensive validation coverage > Canonical page: https://elysiatools.com/en/tools/api-contract-mutation-tester - **Category:** Development - **Keywords:** openapi, mutation testing, api hardening, defensive validation, contract testing ## Overview Paste an OpenAPI 3.x document and let the tool derive valid baseline requests from each documented operation. It then mutates request fields into semantically risky values such as omitted required fields, negative numbers, enum violations, whitespace-only strings, or special-character payloads. How to use it: - OpenAPI Specification: paste a YAML or JSON OpenAPI 3.x document - Base URL: leave empty for offline mutation-plan generation, or point it at a real backend such as https://api.example.com - Execute Mutations: when enabled, the tool actually sends the mutated requests - Authorization Header: optional raw header value such as Bearer \- Mutations Per Field: caps how many semantic mutations are generated per field - Request Timeout (ms): limits real-request execution time What it tests: - Required-field omission - Special-character and suspicious string payloads - Negative or oversized numeric values - Invalid enum members - Wrong scalar-vs-array shapes How to read the output: - defended: the backend rejected the mutated request - accepted: the backend still returned a success code for the mutated request - documented: the observed status code exists in the OpenAPI responses section ## Inputs - **OpenAPI Specification** (textarea): Paste an OpenAPI 3.x YAML or JSON document here... - **Base URL** (text): https://api.example.com - **Execute Mutations** (checkbox) - **Authorization Header** (text): Bearer - **Mutations Per Field** (number) - **Request Timeout (ms)** (number) ## When to use - When auditing a new API endpoint to ensure it properly rejects malformed or malicious payloads. - Before deploying to production to verify that defensive validation rules match the OpenAPI contract. - When generating a comprehensive list of negative test cases for automated security or QA pipelines. ## How it works - Paste your OpenAPI 3.x specification (YAML or JSON) into the tool to parse documented operations and schemas. - The tool generates valid baseline requests, then applies semantic mutations like negative numbers, missing required fields, or invalid enums. - If a Base URL is provided and execution is enabled, the tool sends the mutated requests to the target backend. - Review the JSON output to see which mutations were 'defended' (rejected by the API) and which were 'accepted' (potentially exposing a validation gap). ## Use cases - Hardening user registration endpoints against invalid email formats, missing age fields, or oversized payloads. - Testing financial or e-commerce APIs to ensure negative numbers or invalid currencies are strictly rejected. - Validating that internal microservices enforce strict contract compliance and do not silently ignore malformed input. ## Frequently asked questions ### What versions of OpenAPI are supported? The tool supports OpenAPI 3.x specifications in both YAML and JSON formats. ### Do I have to send requests to a live server? No. You can leave the Base URL empty and disable execution to generate an offline mutation plan for review. ### How does the tool authenticate with my API? You can provide a raw authorization header, such as a Bearer token, which will be injected into all executed requests. ### What types of mutations are generated? Mutations include required-field omission, negative or oversized numbers, invalid enum members, wrong data types, and special-character payloads. ### What do 'defended' and 'accepted' mean in the results? 'Defended' means your API correctly rejected the invalid request. 'Accepted' means the API returned a success code, indicating a potential missing validation rule. ## Related tools - [Tailwind Color Palette Sync](https://elysiatools.com/en/tools/tailwind-color-palette-sync): Generate theme.extend.colors for tailwind.config.ts from HEX colors, with WCAG contrast levels and optional dark mode. - [API Contract Stress Tester](https://elysiatools.com/en/tools/api-contract-stress-tester): Generate boundary-value test cases from an OpenAPI 3.x document and optionally send them to a real backend to spot contract mismatches - [cURL to Go (net/http) Converter](https://elysiatools.com/en/tools/curl-to-go): Convert a cURL command into a Go net/http code snippet with http.NewRequest, headers, and body - [cURL Command to HAR Converter](https://elysiatools.com/en/tools/curl-to-har-converter): Convert a cURL command into a portable HAR 1.2 request entry. - [cURL to JavaScript (axios) Converter](https://elysiatools.com/en/tools/curl-to-js-axios): Convert a cURL command into a JavaScript axios code snippet with config object, headers, and data - [cURL to JavaScript (fetch) Converter](https://elysiatools.com/en/tools/curl-to-js-fetch): Convert a cURL command into a JavaScript fetch() code snippet with headers, body, and method - [cURL to PHP (cURL) Converter](https://elysiatools.com/en/tools/curl-to-php): Convert a cURL command into a PHP cURL code snippet with curl_setopt, headers, and post fields - [cURL to Python (requests) Converter](https://elysiatools.com/en/tools/curl-to-python): Convert a cURL command into a Python requests code snippet with headers, data, and method ## Samples - [Postman Collections - API Testing](https://elysiatools.com/en/samples/postman-collections): Comprehensive Postman collection examples including API testing, automation scripts, environment variables, mock servers, and advanced testing patterns for REST APIs - [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion - [OpenAI API Samples](https://elysiatools.com/en/samples/openai): Comprehensive OpenAI API examples including GPT models, DALL-E image generation, embeddings, Whisper audio processing, and function calling - [WebGPU Graphics API](https://elysiatools.com/en/samples/webgpu): Modern graphics API for high-performance 3D graphics and GPU computing in the browser ## Related content - [API Contract Definition, Schema Validation, and Change Testing](https://elysiatools.com/en/hubs/api-contract-testing): Define an API contract, validate schemas and captured payloads, detect compatibility risks, and record test acceptance. - [API Versioning and Breaking Change Review](https://elysiatools.com/en/hubs/api-versioning-breaking-change-review): Compare API versions, plan migrations, and accept compatibility before release. These tools do not replace real deployment or runtime monitoring. - [JSON Schema and API Contract Validation Tools](https://elysiatools.com/en/hubs/json-validate): Compare JSON schema validation, OpenAPI response checks, mutation testing, stress testing, and breaking-change detection tools in one hub for API contract review. - [OpenAPI Utility Workflow](https://elysiatools.com/en/hubs/openapi-utility): Generate OpenAPI types and docs, review breaking changes, validate responses, and harden the contract with stress and mutation tests.