Schemathesis - Property-based API Testing for OpenAPI and GraphQL Schemas

Start Testing in Seconds

uvx schemathesis run https://example.schemathesis.io/openapi.json

docker run --rm schemathesis/schemathesis run https://example.schemathesis.io/openapi.json

name: API Tests
on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: schemathesis/action@v2
        with:
          schema: https://example.schemathesis.io/openapi.json

api-tests:
  image: schemathesis/schemathesis:stable
  script:
    - schemathesis run https://example.schemathesis.io/openapi.json

Want to see continuous monitoring in action? Explore Workbench - an API fuzzing dashboard

Core Features

Property-based testing for OpenAPI and GraphQL APIs

Property-Based Testing

Uses property-based testing to automatically generate diverse test cases. Explores your API's behavior systematically rather than testing individual scenarios manually

CI/CD Integration

Integrates with GitHub Actions, GitLab CI, and pytest workflows. Generates detailed test reports and integrates with your existing CI pipeline

Schema Validation

Validates API responses against your OpenAPI specification. Detects when your implementation doesn't match the documented behavior or response structure

Schema-Aware Fuzzing

Creates test inputs based on your schema's data types and constraints. Tests boundary values, type mismatches, and constraint violations to find input handling issues

Extensible Framework

Customize tests with Python hooks and config files. Add authentication, modify test data, and configure different settings per API operation

Reproducible Failures

Failed tests include minimal reproduction cases and curl commands for debugging. Test failures provide exact request data and expected vs actual responses

Academic Research

Published at ICSE 2022

by Zac Hatfield-Dodds, Dmitry Dygalo

Deriving Semantics-Aware Fuzzers from Web API Schemas

Academic evaluation comparing API fuzzing tools found Schemathesis detected 1.4x-4.5x more defects than other tools when testing real-world APIs. The research demonstrates the effectiveness of schema-aware property-based testing approaches.

Read the Paper

Used in Production

Engineers using Schemathesis in real-world applications

Schemathesis is the best tool for fuzz testing of REST API on the market. We at Red Hat use it for examining our applications in functional and integrations testing levels.

Dmitry Misharov

Principal Quality Engineer at RedHat

The tool is incredible; it handles negative scenario testing much faster than I could in Postman, and without the maintenance burden.

Luděk Nový

Quality Engineer at JetBrains

Among the other six tools, Schemathesis is clearly the one that puts the most emphasis on usage by practitioners, with its user-friendliness (e.g., GitHub Actions support) and extensive documentation.

Man Zhang & Andrea Arcuri

Open Problems in Fuzzing RESTful APIs: A Comparison of Tools

Catch API bugs before your users do

Start Testing in Seconds

Core Features

Property-Based Testing

CI/CD Integration

Schema Validation

Schema-Aware Fuzzing

Extensible Framework

Reproducible Failures

Academic Research

Deriving Semantics-Aware Fuzzers from Web API Schemas

Used in Production

Schemathesis is the best tool for fuzz testing of REST API on the market. We at Red Hat use it for examining our applications in functional and integrations testing levels.

The tool is incredible; it handles negative scenario testing much faster than I could in Postman, and without the maintenance burden.

Among the other six tools, Schemathesis is clearly the one that puts the most emphasis on usage by practitioners, with its user-friendliness (e.g., GitHub Actions support) and extensive documentation.

Frequently Asked Questions

Need help?

Ready to test your API?

Start Testing in Seconds

Core Features

Property-Based Testing

CI/CD Integration

Schema Validation

Schema-Aware Fuzzing

Extensible Framework

Reproducible Failures

Academic Research

Deriving Semantics-Aware Fuzzers from Web API Schemas

Used in Production

Schemathesis is the best tool for fuzz testing of REST API on the market. We at Red Hat use it for examining our applications in functional and integrations testing levels.

The tool is incredible; it handles negative scenario testing much faster than I could in Postman, and without the maintenance burden.

Among the other six tools, Schemathesis is clearly the one that puts the most emphasis on usage by practitioners, with its user-friendliness (e.g., GitHub Actions support) and extensive documentation.

Frequently Asked Questions

How does Schemathesis differ from traditional API testing tools?

What types of API bugs can Schemathesis detect?

What's the maintenance burden?

Which API specifications are supported?

How can I integrate Schemathesis into my CI/CD pipeline?

Can Schemathesis test authenticated APIs?

Can I use Schemathesis with my existing test framework?

Need help?

Ready to test your API?