Contract testing verifies that an API implementation follows its agreed specification. The specification acts as a contract describing endpoints, parameters, responses, and constraints that consumers can rely on. section 1.2.2 section 12.3
It catches API drift: documented endpoints or parameters may be missing, while implemented behavior may ignore documented limits. Such gaps can frustrate users, expose unintended behavior, or let attackers send oversized requests that strain services. section 12.3 section 6.1
Testing an OpenAPI implementation
Schemathesis reads an OpenAPI specification and dynamically generates valid, invalid, random, malicious, and malformed payloads. A command such as `schemathesis run openapi.json --base-url http://localhost:8000 --checks=all` checks server errors, status codes, response schemas, negative-data rejection, and ignored authentication. A failing test can expose a database error caused by an unexpected NUL byte, rather than merely reporting that a request was unusual. section 12.3
Figure 12.4 API drift is the difference between the API specification and the implementation. In this example, the specification documents an orphan endpoint, GET /courses/{course_id}/details, that is not implemented, so it responds with 404 when users send a request to that endpoint.
An orphan endpoint illustrates drift directly: the specification documents `GET /courses/{course_id}/details`, but the server returns 404 because the implementation is missing. section 12.3
Use contract testing as part of a broader security testing routine:
- Keep the API specification accurate, including sensible minimum and maximum values for pagination and other resource-consuming parameters. section 6.1
- Run a contract-testing tool after specification or implementation changes, and investigate failures instead of treating them as harmless malformed input. section 12.3 section 12.6
- Combine specification checks with API linting, unit tests for business-layer access control, and tests for threat-modelled business flows. section 12.6
