leandroomargarcia API Tester
Especialista en testing comprehensivo de APIs incluyendo funcionalidad, performance, y contratos. Encuentra breaking points antes de que los usuarios lo hagan.
Cuándo Usar Este Skill
- Testear APIs antes de launch
- Load testing para escenarios virales
- Validar contratos OpenAPI
- Identificar bottlenecks de performance
- Testing de seguridad de APIs
- Verificar backward compatibility
Performance Targets
RESPONSE TIME (P95):
- Simple GET: <100ms
- Complex query: <500ms
- Write operations: <1000ms
- File uploads: <5000ms
THROUGHPUT:
- Read-heavy: >1000 RPS/instance
- Write-heavy: >100 RPS/instance
- Mixed: >500 RPS/instance
ERROR RATES:
- 5xx errors: <0.1%
- 4xx errors: <5%
- Timeouts: <0.01%
API Test Types
UNIT TESTS:
- Individual endpoint logic
- Input validation
- Error handling
- Edge cases
INTEGRATION TESTS:
- Database interactions
- External service calls
- Authentication flows
- End-to-end workflows
CONTRACT TESTS:
- OpenAPI spec compliance
- Response schema validation
- Required field presence
- Data type checking
LOAD TESTS:
- Sustained load
- Spike traffic
- Breaking point
- Recovery time
SECURITY TESTS:
- Authentication bypass
- Authorization flaws
- Injection attacks
- Rate limiting
Quick Test Commands
# Simple endpoint test
curl -X GET "https://api.example.com/users" \
-H "Authorization: Bearer $TOKEN"
# Load test with curl
for i in {1..1000}; do
curl -s -o /dev/null \
-w "%{http_code} %{time_total}\\n" \
https://api.example.com/endpoint &
done
# k6 smoke test
k6 run --vus 10 --duration 30s script.js
# Contract validation
dredd api-spec.yml https://api.example.com
# Performance profiling
ab -n 1000 -c 100 https://api.example.com/endpoint
k6 Load Test Script
import http from 'k6/http';
import { check, sleep } from 'k6';
export const options = {
stages: [
{ duration: '1m', target: 50 }, // Ramp up
{ duration: '3m', target: 50 }, // Sustained
{ duration: '1m', target: 100 }, // Spike
{ duration: '2m', target: 0 }, // Ramp down
],
thresholds: {
http_req_duration: ['p(95)<500'],
http_req_failed: ['rate<0.01'],
},
};
export default function () {
const res = http.get('https://api.example.com/users');
check(res, {
'status is 200': (r) => r.status === 200,
'response time < 500ms': (r) => r.timings.duration < 500,
});
sleep(1);
}
Load Test Scenarios
1. SMOKE TEST
- 1-5 VUs
- 1-2 minutes
- Verify basics work
2. LOAD TEST
- Expected normal load
- 5-10 minutes
- Verify performance targets
3. STRESS TEST
- Beyond expected load
- Find breaking point
- Observe degradation
4. SPIKE TEST
- Sudden 10x traffic
- Measure recovery
- Test auto-scaling
5. SOAK TEST
- Normal load
- Extended duration (hours)
- Find memory leaks
Test Report Template
## API Test Results: [API Name]
**Test Date:** [Date]
**Version:** [API Version]
**Tester:** @person
### Performance Summary
| Metric | Value | Target | Status |
|--------|-------|--------|--------|
| Avg Response | Xms | <200ms | 🟢 |
| P95 Response | Yms | <500ms | 🟢 |
| P99 Response | Zms | <1000ms | 🟡 |
| Error Rate | X% | <0.1% | 🟢 |
### Load Test Results
- **Peak RPS:** X
- **Breaking Point:** Y concurrent users
- **Recovery Time:** Z seconds
### Endpoints Tested
| Endpoint | Method | Avg | P95 | Errors |
|----------|--------|-----|-----|--------|
| /users | GET | Xms | Yms | 0 |
| /users | POST | Xms | Yms | 0 |
### Issues Found
1. [Issue + severity + recommendation]
2. [Issue + severity + recommendation]
### Recommendations
- [Optimization 1]
- [Optimization 2]
Common Issues Checklist
PERFORMANCE:
☐ Unbounded queries (no pagination)
☐ Missing database indexes
☐ N+1 query problems
☐ Synchronous operations that should be async
☐ No caching
☐ Large payloads
RELIABILITY:
☐ No rate limiting
☐ No circuit breakers
☐ Poor timeout handling
☐ No retry logic
☐ Connection pool exhaustion
☐ Race conditions
SECURITY:
☐ SQL/NoSQL injection
☐ Authentication bypass
☐ Authorization flaws
☐ Information disclosure
☐ Missing input validation
☐ Insecure direct object reference
Security Testing
AUTHENTICATION:
- Test without token
- Test with invalid token
- Test with expired token
- Test token reuse after logout
AUTHORIZATION:
- Access other user's data
- Privilege escalation
- IDOR (Insecure Direct Object Reference)
INPUT VALIDATION:
- SQL injection: ' OR '1'='1
- NoSQL injection: {"$gt": ""}
- XSS in inputs
- Oversized payloads
RATE LIMITING:
- Verify limits enforced
- Test bypass attempts
- Check error responses
Contract Testing
# OpenAPI spec example
openapi: 3.0.0
paths:
/users:
get:
responses:
'200':
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/User'
components:
schemas:
User:
type: object
required:
- id
- email
properties:
id:
type: string
email:
type: string
format: email
# Validate with Dredd
dredd api-spec.yml https://api.example.com
# Or with Prism
prism proxy api-spec.yml https://api.example.com
Monitoring During Tests
WATCH DURING LOAD TESTS:
Server:
- CPU utilization
- Memory usage
- Disk I/O
- Network I/O
Database:
- Query time
- Connection count
- Lock contention
- Replication lag
Application:
- Response times
- Error rates
- Queue depth
- Cache hit rate
Mejores Prácticas
- Test before every release - Regression matters
- Simulate real traffic - Synthetic ≠ production
- Test at scale - Small tests miss issues
- Monitor during tests - Observe everything
- Document baseline - Know what "normal" looks like
- Automate in CI/CD - Manual testing doesn't scale
Filosofía
"APIs that aren't tested under pressure will fail under pressure. Find the breaking points before your users do."
El objetivo es que las APIs puedan manejar el dream scenario de crecimiento viral sin convertirse en pesadilla de downtime.