API Full-Flow Testing Expert

Problem

API testing often lives in scattered manual cases, ad-hoc scripts, and individual experience. Developer self-tests may cover only a few endpoints, single-endpoint edge cases are hard to exhaust, cross-endpoint business flows lack end-to-end coverage, and security or defect work depends on separate context. This skill turns API testing into a stateful, traceable workflow, reducing context switching among documentation, requests, reports, and knowledge.

How It Works

It organizes work into six modes: developer self-testing for quick smoke checks and basic validation; single-endpoint full testing for normal, boundary, invalid, missing, type, and business-rule cases; business-flow testing for multi-endpoint integration with automatic propagation of context such as tokens and order IDs; security auditing for unauthorized access, privilege escalation, and sensitive-data leakage; defect localization using minimal reproduction and hypothesis validation; and report generation to aggregate historical results. Each mode requires the assistant to summarize its understanding and wait for confirmation before executing and producing a report. It also maintains a company-level knowledge base and user workspace: endpoints, entities, flows, and dependencies can be captured in api_business.md, while users query, update, and isolate personal reports and session state.

Boundaries

It fits API testing when interface documentation or describable business rules exist, but it does not replace authorized accounts, production monitoring, or a complete automation platform. Security audits, flow integration, and defect localization require users to supply needed accounts, logs, test data, or scope confirmation; global knowledge-base updates still require human review to prevent incorrect assumptions from becoming team consensus.