API Test Checklist
An interactive checklist for testing any API.
0 / 18 checks complete
Status & response
Validation
Authentication & authorization
Data & state
Edge cases & reliability
About API Test Checklist
The API Test Checklist is an interactive list of the checks that separate "I called the endpoint and it worked" from actually tested: status codes, error responses, auth and permissions, validation, pagination, idempotency, performance and more. Tick items off as you cover them and reset for the next endpoint.
Checklists exist because API test gaps are predictable — everyone tests the happy path, and the bugs live in the missing-auth, malformed-body and boundary cases. Working through the list makes your coverage systematic rather than aspirational.
How to use
- Open the checklist next to the endpoint you are testing.
- Work through the sections, ticking each check as you complete it.
- Treat any unticked item as an explicit decision: cover it, or note why it does not apply.
- Click "Reset" to clear all checkboxes and start the next endpoint fresh.
Frequently asked questions
Which API checks do teams forget most often?
Error-path behavior: wrong content type, missing auth token, expired token, malformed JSON, oversized payloads and concurrent updates. Happy paths are always covered; contracts break in the error paths.
Do I need every item for every endpoint?
No — a public read-only endpoint has no permission matrix to test. The value is in deciding consciously: skipping an item on purpose is fine, skipping it by forgetting is how escapes happen.
Can I use this for exploratory testing sessions?
Yes — it works well as a session charter: pick an endpoint, run the list top to bottom, and log findings as you go. The reset button makes it reusable across sessions.