Fuzzing tests an API by submitting random, unexpected, malformed, or semi-malformed inputs and checking whether responses remain documented and valid. In API delivery, it complements conformance checks generated from an OpenAPI definition. section 1.5.4 section 7.4.1
A practical Schemathesis workflow is:
- Start the API gateway and service, then run the Schemathesis CLI against the OpenAPI definition. section 7.4.1
- Enable all checks, data-generation methods, authentication headers, a base URL, and cassette recording for reproducibility. section 7.4.1
- Inspect failures such as undocumented response properties, then correct the implementation or schema rather than treating a passing request as sufficient. section 1.5.4
Product Catalog API
Running Schemathesis against product-catalog-v1-0.oas.yaml can reuse the documented productId UUID and record requests in cassette.yaml. A failing response may reveal that numberOfReviews and reviewRating are returned although the schema disallows them; a passing run reports 101 of 101 checks passed. section 7.4.1
Listing 7.3 Running Schemathesis
st run #1 --checks all #2 --contrib-openapi-formats-uuid #3 --cassette-path cassette.yaml #4 --data-generation-method all #5 --base-url http://localhost:8000 #6 --header "X-API-Key: my_secret_api_key" #7 product-catalog-v1-0.oas.yaml #8
Use the runnable command listing to configure checks, generated data, authentication, the service URL, cassette output, and the OpenAPI input. section 7.4.1
