API Testing: Exploratory Methodology
Methodology for hunting contract-conformance, functional, edge-case, auth, and consistency defects on
a running REST or GraphQL API — the API-surface counterpart to the web tester triad.
Reference Modules
- Why This Agent Exists
- Inputs
- Relationship to Other Agents
- Non-Destructive Constraint — the hard rule.
- Session-Based Methodology — charters, tours, SFDIPOT,
CRUSSPIC STMPL.
- Test Dimensions Checklist Part 1 and
Part 2 — contract conformance, status codes,
error envelopes, edge cases, auth, consistency, pagination, idempotency, GraphQL, performance,
security.
- Mandatory Systematic Sweeps Part 1 and
Part 2 — operation × property matrix, convention
round-trip, declared-invariant conformance, self-completeness check.
- Driving the API and Contract Comparison — how
to drive curl/GraphQL, contract-and-specs comparison.
- Spec-Gap Detection — proposing behaviours for
specs/**.
- Defect Anatomy and Severity —
AET-### anatomy,
severity/priority scales.
- Output Modes Overview and
Output Mode
plan — the output-mode selection table and the
explicitly authorized plan mode's document set.
- Output Modes
delivery/local-tmp and Procedure
— the other two output modes and the 10-step procedure summary.
- Quality Guidelines and Constraints
Core Principles
- Enumerate, never sample — the mandatory sweeps cover every operation, not a spot check.
- Cite the contract or spec, never a vibe — every "expected" quotes an OpenAPI clause, SDL type,
or
.feature scenario.
- Non-destructive by default — read-only unless per-run authorized; redact every credential.
Quality-Gate Lifecycle Handoff
When the API quality gate provides delegated-gate-ids and an evidence ledger, omit only exact
registry IDs or predicates connected through verifies. Preserve the ledger and pending state;
never rerun or infer delegated work. The live contract, authorization, edge, and runtime sweeps stay
in scope. See the
lifecycle ownership policy.
The API gate uses the complete methodology once for discovery. After its single fix and
rebuild/redeployment pass, verification reproduces only the original in-threshold findings and
smoke-tests affected API behaviour. It does not repeat mandatory full-discovery sweeps or probe
unrelated endpoints. A clean discovery passes immediately; no result automatically starts another
run.
Related Skills
web-testing-exploratory-methodology — rendered-UI counterpart (disjoint surface).plan-creating-project-plans, plan-writing-gherkin-criteria, docs-applying-content-quality.
1---2name: api-testing-exploratory-methodology3description: Complete methodology for spec-aware, contract-aware session-based exploratory testing of a live REST or GraphQL API — inputs, relationships, non-destructive constraint, charter/tour/SFDIPOT methodology, test dimensions, mandatory systematic sweeps, driving the API, contract-and-specs ground truth, defect anatomy, and output modes. Backs the api-exploratory-tester agent.4---56# API Testing: Exploratory Methodology78Methodology for hunting contract-conformance, functional, edge-case, auth, and consistency defects on9a **running** REST or GraphQL API — the API-surface counterpart to the web tester triad.1011## Reference Modules12131. [Why This Agent Exists](reference/why-this-agent-exists.md)142. [Inputs](reference/inputs.md)153. [Relationship to Other Agents](reference/relationship-to-other-agents.md)164. [Non-Destructive Constraint](reference/non-destructive-constraint.md) — the hard rule.175. [Session-Based Methodology](reference/session-based-methodology.md) — charters, tours, SFDIPOT,18 CRUSSPIC STMPL.196. [Test Dimensions Checklist Part 1](reference/test-dimensions-checklist-part1.md) and20 [Part 2](reference/test-dimensions-checklist-part2.md) — contract conformance, status codes,21 error envelopes, edge cases, auth, consistency, pagination, idempotency, GraphQL, performance,22 security.237. [Mandatory Systematic Sweeps Part 1](reference/mandatory-sweeps-part1.md) and24 [Part 2](reference/mandatory-sweeps-part2.md) — operation × property matrix, convention25 round-trip, declared-invariant conformance, self-completeness check.268. [Driving the API and Contract Comparison](reference/driving-and-contract-comparison.md) — how27 to drive curl/GraphQL, contract-and-specs comparison.289. [Spec-Gap Detection](reference/spec-gap-detection.md) — proposing behaviours for `specs/**`.2910. [Defect Anatomy and Severity](reference/defect-anatomy-and-severity.md) — `AET-###` anatomy,30 severity/priority scales.3111. [Output Modes Overview](reference/output-modes-overview.md) and32 [Output Mode `plan`](reference/output-mode-plan.md) — the output-mode selection table and the33 explicitly authorized `plan` mode's document set.3412. [Output Modes `delivery`/`local-tmp` and Procedure](reference/output-modes-delivery-localtmp-and-procedure.md)35 — the other two output modes and the 10-step procedure summary.3613. [Quality Guidelines and Constraints](reference/quality-guidelines-and-constraints.md)3738## Core Principles3940- **Enumerate, never sample** — the mandatory sweeps cover every operation, not a spot check.41- **Cite the contract or spec, never a vibe** — every "expected" quotes an OpenAPI clause, SDL type,42 or `.feature` scenario.43- **Non-destructive by default** — read-only unless per-run authorized; redact every credential.4445## Quality-Gate Lifecycle Handoff4647When the API quality gate provides `delegated-gate-ids` and an evidence ledger, omit only exact48registry IDs or predicates connected through `verifies`. Preserve the ledger and pending state;49never rerun or infer delegated work. The live contract, authorization, edge, and runtime sweeps stay50in scope. See the51[lifecycle ownership policy](../../../repo-governance/workflows/meta/workflow-identifier/check-fix-lifecycle-validation-ownership.md).5253The API gate uses the complete methodology once for discovery. After its single fix and54rebuild/redeployment pass, verification reproduces only the original in-threshold findings and55smoke-tests affected API behaviour. It does not repeat mandatory full-discovery sweeps or probe56unrelated endpoints. A clean discovery passes immediately; no result automatically starts another57run.5859## Related Skills6061- `web-testing-exploratory-methodology` — rendered-UI counterpart (disjoint surface).62- `plan-creating-project-plans`, `plan-writing-gherkin-criteria`, `docs-applying-content-quality`.
wahidyankf