API Contract Stress Tester

Paste an OpenAPI 3.x document into "OpenAPI Specification". Both YAML and JSON are supported.

What to provide:

• A valid OpenAPI 3.x document with paths, parameters, request bodies, and responses
• Optional schema refs under components.schemas for request-body dereferencing
• Optional Base URL if you want the tool to send the generated boundary cases to a real backend

How the fields work:

• OpenAPI Specification: paste the full YAML or JSON contract
• Base URL: leave empty for offline case generation, or enter something like https://api.example.com to execute requests
• Execute Real Requests: when enabled, the tool sends generated invalid or edge-case requests to the Base URL
• Authorization Header: optional raw header value such as Bearer
• Maximum Cases Per Field: limits how many boundary cases are generated for each parameter or request-body field
• Request Timeout (ms): caps how long each real request can run before aborting

What gets tested:

• Missing required fields
• Empty strings, too-short strings, and too-long strings
• Invalid enum values
• Numbers below minimum or above maximum
• Wrong scalar or array types for documented fields

Notes:

• If Execute Real Requests is off, the tool only generates a contract-focused test plan.
• If Execute Real Requests is on, the report marks whether each observed HTTP status is documented in the OpenAPI responses.
• Path, query, header, and JSON body fields are covered; the current version focuses on application/json request bodies.