Test the contract

Check required fields, response types, status codes, and documented error shapes. Consumers depend on failure responses as much as successful ones.

Challenge the boundaries

Try empty strings, maximum sizes, unknown values, and invalid encodings where relevant. Verify that rejected input does not leave partial state behind.

Check authorization

Use distinct test identities to verify that one user cannot read or change another user’s resources. Authentication alone does not prove that access is authorized.

Simulate dependency failures

Test timeouts and unavailable downstream services in a controlled environment. Confirm that retries do not create duplicate side effects.

Document the evidence

Keep a clear record of what was tested and which assumptions remain. A checklist is a starting point, not proof of complete coverage.