Schemathesis - Property-based API Testing for OpenAPI and GraphQL Schemas

Start Testing in Seconds

uvx schemathesis run https://example.schemathesis.io/openapi.json

docker run --rm schemathesis/schemathesis run https://example.schemathesis.io/openapi.json

name: API Tests
on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: schemathesis/action@v3
        with:
          schema: https://example.schemathesis.io/openapi.json

api-tests:
  image: schemathesis/schemathesis:stable
  script:
    - schemathesis run https://example.schemathesis.io/openapi.json

Want to see continuous monitoring in action? Explore Workbench - an API fuzzing dashboard

Curious what your tests actually cover? See TraceCov - schema-level coverage for your OpenAPI spec

Trusted by engineers from

Core Features

Property-based testing for OpenAPI and GraphQL APIs

Property-Based Testing

Generates diverse test cases from your schema's types and constraints. Probes boundary values, type mismatches, and constraint violations instead of the handful of scenarios you would write by hand

Schema Validation

Validates API responses against your OpenAPI specification. Detects when your implementation doesn't match the documented behavior or response structure

Stateful Testing

Chains operations into multi-step workflows, inferring the links between them from your schema. Finds bugs that only appear after create, read, update, and delete run in sequence

Adaptive Testing

Learns from responses mid-run: validation rules from rejected inputs, resource IDs from successful ones, auth requirements from 401s. Later requests reuse what earlier ones uncovered

Config, Not Code

A schemathesis.toml file covers auth, rate limits, test volume, and per-operation overrides. Python is for extensions, not for getting started

Custom Checks

Assert your own business rules against every generated response, in Python, alongside the built-in checks. Failures report the same way, with the same reproduction commands

Fuzz Dictionaries

Feed in real IDs, wordlists, or LLM-generated payloads and mix them with generated data at whatever probability you choose. Plain value lists in config, no code required

Reports & Replay

Export JUnit, VCR, HAR, NDJSON, JSON, or Allure. Every failure is saved with a curl command and can be replayed later to confirm the fix

Academic Research

Published at ICSE 2022

by Zac Hatfield-Dodds, Dmitry Dygalo

Deriving Semantics-Aware Fuzzers from Web API Schemas

Academic evaluation comparing API fuzzing tools found Schemathesis detected 1.4x-4.5x more defects than other tools when testing real-world APIs. The research demonstrates the effectiveness of schema-aware property-based testing approaches.

Read the Paper

Used in Production

Engineers using Schemathesis in real-world applications

Schemathesis is the best tool for fuzz testing of REST API on the market. We at Red Hat use it for examining our applications in functional and integrations testing levels.

Dmitry Misharov

Principal Quality Engineer at RedHat

The tool is incredible; it handles negative scenario testing much faster than I could in Postman, and without the maintenance burden.

Luděk Nový

Quality Engineer at JetBrains

Among the other six tools, Schemathesis is clearly the one that puts the most emphasis on usage by practitioners, with its user-friendliness (e.g., GitHub Actions support) and extensive documentation.

Man Zhang & Andrea Arcuri

Open Problems in Fuzzing RESTful APIs: A Comparison of Tools

Frequently Asked Questions

Schemathesis uses property-based testing (built on Hypothesis) to automatically generate thousands of test cases from your API schema. Unlike traditional tools requiring manual test scripting, it finds edge cases and validation bugs with zero per-endpoint maintenance.

No. The CLI takes a schema URL or file and runs. Everything else - authentication, rate limits, test volume, report formats, fuzz dictionaries, per-operation overrides - lives in a schemathesis.toml file. Python is only needed for extensions such as custom checks, hooks, or the pytest integration.

Server crashes, schema violations, validation bypasses, integration failures, and stateful bugs in multi-step workflows. Production schemas typically surface 5-15 issues on first run.

Minimal. Tests derive directly from your schema with zero per-endpoint maintenance. Add or modify endpoints, and tests automatically adapt when your schema updates.

OpenAPI (Swagger) 2.0, 3.0, 3.1, and 3.2, plus GraphQL schemas. Load schemas from local files, URLs, or programmatically via the Python API.

Use the GitHub Action (schemathesis/action@v3), Docker image, or install via pip/uvx. Exports JUnit, VCR, HAR, NDJSON, JSON, and Allure reports. Returns standard exit codes for build gating, and a baseline file keeps existing failures from blocking the build so CI fails only on new ones. Works with all major CI platforms.

Yes. Declare credentials in schemathesis.toml, per security scheme, with environment variable substitution for secrets - or pass them as CLI flags (--auth, --header). Supports Bearer tokens, Basic auth, and API keys, with Python hooks available for token refresh and other dynamic flows.

Yes. Run Schemathesis CLI alongside any test framework, or use native pytest integration for Python projects. The CLI works standalone or can be integrated into existing test suites and build scripts.

Need help?

Get technical support and discuss implementation questions

Ask configuration questions
Report bugs and issues
Share integration examples

Join our Discord

Ready to test your API?

Start testing in minutes with our CLI or Python integration.

Install Now View Docs