# API Tester

> Asegura que las APIs funcionen bajo presión. Usa este skill para testing de APIs, load testing, contract validation, performance profiling, y encontrar breaking points antes de que los usuarios los encuentren.

- Skill: `leandroomargarcia/api-tester` (Agent Skill)
- Install (CLI): `npx skillmds@latest add leandroomargarcia/api-tester`
- Raw SKILL.md: https://api.skillmd.com/api/skills/leandroomargarcia/api-tester/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: leandroomargarcia (https://skillmd.com/u/leandroomargarcia)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/leandroomargarcia/api-tester

---


# API Tester

Especialista en testing comprehensivo de APIs incluyendo funcionalidad, performance, y contratos. Encuentra breaking points antes de que los usuarios lo hagan.

## Cuándo Usar Este Skill

- Testear APIs antes de launch
- Load testing para escenarios virales
- Validar contratos OpenAPI
- Identificar bottlenecks de performance
- Testing de seguridad de APIs
- Verificar backward compatibility

## Performance Targets

```
RESPONSE TIME (P95):
- Simple GET: <100ms
- Complex query: <500ms
- Write operations: <1000ms
- File uploads: <5000ms

THROUGHPUT:
- Read-heavy: >1000 RPS/instance
- Write-heavy: >100 RPS/instance
- Mixed: >500 RPS/instance

ERROR RATES:
- 5xx errors: <0.1%
- 4xx errors: <5%
- Timeouts: <0.01%
```

## API Test Types

```
UNIT TESTS:
- Individual endpoint logic
- Input validation
- Error handling
- Edge cases

INTEGRATION TESTS:
- Database interactions
- External service calls
- Authentication flows
- End-to-end workflows

CONTRACT TESTS:
- OpenAPI spec compliance
- Response schema validation
- Required field presence
- Data type checking

LOAD TESTS:
- Sustained load
- Spike traffic
- Breaking point
- Recovery time

SECURITY TESTS:
- Authentication bypass
- Authorization flaws
- Injection attacks
- Rate limiting
```

## Quick Test Commands

```bash
# Simple endpoint test
curl -X GET "https://api.example.com/users" \
  -H "Authorization: Bearer $TOKEN"

# Load test with curl
for i in {1..1000}; do
  curl -s -o /dev/null \
    -w "%{http_code} %{time_total}\\n" \
    https://api.example.com/endpoint &
done

# k6 smoke test
k6 run --vus 10 --duration 30s script.js

# Contract validation
dredd api-spec.yml https://api.example.com

# Performance profiling
ab -n 1000 -c 100 https://api.example.com/endpoint
```

## k6 Load Test Script

```javascript
import http from 'k6/http';
import { check, sleep } from 'k6';

export const options = {
  stages: [
    { duration: '1m', target: 50 },   // Ramp up
    { duration: '3m', target: 50 },   // Sustained
    { duration: '1m', target: 100 },  // Spike
    { duration: '2m', target: 0 },    // Ramp down
  ],
  thresholds: {
    http_req_duration: ['p(95)<500'],
    http_req_failed: ['rate<0.01'],
  },
};

export default function () {
  const res = http.get('https://api.example.com/users');
  
  check(res, {
    'status is 200': (r) => r.status === 200,
    'response time < 500ms': (r) => r.timings.duration < 500,
  });
  
  sleep(1);
}
```

## Load Test Scenarios

```
1. SMOKE TEST
   - 1-5 VUs
   - 1-2 minutes
   - Verify basics work

2. LOAD TEST
   - Expected normal load
   - 5-10 minutes
   - Verify performance targets

3. STRESS TEST
   - Beyond expected load
   - Find breaking point
   - Observe degradation

4. SPIKE TEST
   - Sudden 10x traffic
   - Measure recovery
   - Test auto-scaling

5. SOAK TEST
   - Normal load
   - Extended duration (hours)
   - Find memory leaks
```

## Test Report Template

```markdown
## API Test Results: [API Name]

**Test Date:** [Date]
**Version:** [API Version]
**Tester:** @person

### Performance Summary
| Metric | Value | Target | Status |
|--------|-------|--------|--------|
| Avg Response | Xms | <200ms | 🟢 |
| P95 Response | Yms | <500ms | 🟢 |
| P99 Response | Zms | <1000ms | 🟡 |
| Error Rate | X% | <0.1% | 🟢 |

### Load Test Results
- **Peak RPS:** X
- **Breaking Point:** Y concurrent users
- **Recovery Time:** Z seconds

### Endpoints Tested
| Endpoint | Method | Avg | P95 | Errors |
|----------|--------|-----|-----|--------|
| /users | GET | Xms | Yms | 0 |
| /users | POST | Xms | Yms | 0 |

### Issues Found
1. [Issue + severity + recommendation]
2. [Issue + severity + recommendation]

### Recommendations
- [Optimization 1]
- [Optimization 2]
```

## Common Issues Checklist

```
PERFORMANCE:
☐ Unbounded queries (no pagination)
☐ Missing database indexes
☐ N+1 query problems
☐ Synchronous operations that should be async
☐ No caching
☐ Large payloads

RELIABILITY:
☐ No rate limiting
☐ No circuit breakers
☐ Poor timeout handling
☐ No retry logic
☐ Connection pool exhaustion
☐ Race conditions

SECURITY:
☐ SQL/NoSQL injection
☐ Authentication bypass
☐ Authorization flaws
☐ Information disclosure
☐ Missing input validation
☐ Insecure direct object reference
```

## Security Testing

```
AUTHENTICATION:
- Test without token
- Test with invalid token
- Test with expired token
- Test token reuse after logout

AUTHORIZATION:
- Access other user's data
- Privilege escalation
- IDOR (Insecure Direct Object Reference)

INPUT VALIDATION:
- SQL injection: ' OR '1'='1
- NoSQL injection: {"$gt": ""}
- XSS in inputs
- Oversized payloads

RATE LIMITING:
- Verify limits enforced
- Test bypass attempts
- Check error responses
```

## Contract Testing

```yaml
# OpenAPI spec example
openapi: 3.0.0
paths:
  /users:
    get:
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/User'

components:
  schemas:
    User:
      type: object
      required:
        - id
        - email
      properties:
        id:
          type: string
        email:
          type: string
          format: email
```

```bash
# Validate with Dredd
dredd api-spec.yml https://api.example.com

# Or with Prism
prism proxy api-spec.yml https://api.example.com
```

## Monitoring During Tests

```
WATCH DURING LOAD TESTS:

Server:
- CPU utilization
- Memory usage
- Disk I/O
- Network I/O

Database:
- Query time
- Connection count
- Lock contention
- Replication lag

Application:
- Response times
- Error rates
- Queue depth
- Cache hit rate
```

## Mejores Prácticas

1. **Test before every release** - Regression matters
2. **Simulate real traffic** - Synthetic ≠ production
3. **Test at scale** - Small tests miss issues
4. **Monitor during tests** - Observe everything
5. **Document baseline** - Know what "normal" looks like
6. **Automate in CI/CD** - Manual testing doesn't scale

## Filosofía

> "APIs that aren't tested under pressure will fail under pressure. Find the breaking points before your users do."

El objetivo es que las APIs puedan manejar el dream scenario de crecimiento viral sin convertirse en pesadilla de downtime.