# API Testing — Routebase

> Test suites, security scans, and automation that treat your spec as the contract to enforce.

Canonical page: https://routebase.dev/api-testing/

## Assert everything

Suites of chained requests — assert on status, JSON paths, headers, body, latency, and schema with 10 operators.

- 6 assertion types with 10 operators, drag-and-drop suites
- Chained requests: extract values, reuse them downstream
- Pre-request and post-response JavaScript

## Auth like production

Ten auth schemes resolved per environment — run the same suite against staging and prod.

- OAuth2, Bearer, API Key, JWT, AWS SigV4, and more
- Environment variables in requests and assertions

## Test data, managed

Fixtures, seeds, and snapshots put the API in a known state before every run.

- Fixtures with per-suite scope control
- Pre/post-run seeds with loops and captures
- Logical snapshots restore known state

## Security is a test, too

OWASP API Top 10 scanning with multi-identity personas, finding triage, and a security score.

- 13 scanners: BOLA, broken auth, SSRF, fuzzing, and more
- Personas for multi-identity access testing
- Triage workflow with audit trail and score dashboard

## Runs where you work

CLI for CI, API triggers, schedules, and signed webhooks — testing that fits your pipeline.

- CLI runner with CI exit codes
- Cron schedules and API-key triggers
- HMAC-signed webhooks on completion

---

[Routebase](https://routebase.dev/) — [Sign up](https://app.routebase.dev/): Every account starts with a 14-day Pro trial — no credit card required.