API Contract Mutation Tester

Paste an OpenAPI 3.x document and let the tool derive valid baseline requests from each documented operation. It then mutates request fields into semantically risky values such as omitted required fields, negative numbers, enum violations, whitespace-only strings, or special-character payloads.

How to use it:

• OpenAPI Specification: paste a YAML or JSON OpenAPI 3.x document
• Base URL: leave empty for offline mutation-plan generation, or point it at a real backend such as https://api.example.com
• Execute Mutations: when enabled, the tool actually sends the mutated requests
• Authorization Header: optional raw header value such as Bearer
• Mutations Per Field: caps how many semantic mutations are generated per field
• Request Timeout (ms): limits real-request execution time

What it tests:

• Required-field omission
• Special-character and suspicious string payloads
• Negative or oversized numeric values
• Invalid enum members
• Wrong scalar-vs-array shapes

How to read the output:

• defended: the backend rejected the mutated request
• accepted: the backend still returned a success code for the mutated request
• documented: the observed status code exists in the OpenAPI responses section