Schemathesis is a Python API testing tool that reads an API specification and dynamically generates property-based test cases. It checks whether a live server conforms to its contract while probing malformed, random, and potentially malicious inputs. section 12.3
Use Schemathesis to:
- Detect API drift, such as documented endpoints or parameters that the implementation does not support. section 12.3
- Expose crashes, unexpected responses, schema violations, and ignored authentication through automated checks. section 12.3
- Run contract tests continuously after design validation, while adding separate unit tests for business logic and access control. section 12.6
Run tests against a live API
Install Schemathesis with `uv add --dev schemathesis` or `pip install schemathesis`, start the server, then run `schemathesis run openapi.json --base-url http://localhost:8000 --experimental=openapi-3.1 -H 'Authorization: Bearer <token>' --checks=all`. A generated case containing a NUL byte in `phone_number` produced a database error, revealing an unhandled input path. The failure can then be fixed and retested. section 12.3
Figure 12.4 API drift is the difference between the API specification and the implementation. In this example, the specification documents an orphan endpoint, GET /courses/{course_id}/details, that is not implemented, so it responds with 404 when users send a request to that endpoint.
API drift appears when the specification documents `GET /courses/{course_id}/details` but the server returns 404 because the endpoint is not implemented. section 12.3
