Test Suite

Validate the functional and non-functional behavior of an API by generating, reviewing, managing, executing, and validating API test cases with AI-generated coverage, assertions, and schema validation.

A Test Suite allows you to validate the functional and non-functional behavior of an API by automatically generating, reviewing, managing, executing, and validating API test cases. Test Suite helps teams create comprehensive API test coverage using AI-generated test cases, authentication and environment management, assertions, schema validation, business-rule validation, and detailed execution results.

Key capabilities

• Automatically handle API authentication and token management, and reuse tokens across test cases in a test suite.
• Execute test suites against different environments.
• Organize test cases using tags, and filter/execute test cases by type or category.
• Automatically generate test cases for a selected API, categorized by priority and testing category.
• Use AI to review generated test cases and identify missing scenarios.
• Add system-suggested and manual assertions, and validate API responses after execution.
• Validate API responses against OpenAPI schemas and custom business rules.
• Support functional, security, performance, and rate-limiting test scenarios.
• Execute individual test cases or the complete test suite, and review detailed results and history.

Creating a test suite

Test suites can be created manually, or the system can automatically generate a test suite based on the available API definitions and configuration.

1. 1

   Create a test suite

   Create a new test suite and provide the required details.

2. 2

   Select the environment

   Choose the environment the test suite runs against — Development, QA, Staging, or Production — so the same suite can be executed anywhere.

3. 3

   Add tags

   Tag test cases or test suites for quick identification, organization, filtering, and execution.

4. 4

   Configure authentication and token reuse

   Configure authentication when the API requires authorization. The generated token can be reused across applicable test cases, avoiding re-authenticating on every request.

5. 5

   Configure a pre-request API

   Use a pre-request API to generate or retrieve a token, create prerequisite data, perform a required setup operation, extract values for later steps, or validate prerequisites with assertions.

6. 6

   Select the API

   Choose the API to validate. This is the basis for generating relevant test cases and validations.

7. 7

   Generate test cases

   Click Generate Test Case to auto-generate test cases covering functional, security, and edge-case scenarios.

8. 8

   Review generated test cases

   Generated cases are categorized by test type, testing category, priority, API behavior, and expected response.

9. 9

   Select test cases

   Filter by type or category and select only the scenarios required for execution.

10. 10

    Perform an AI review

    Run a second-level AI review on the selected test cases to surface missing scenarios, missing categories, and additional edge or negative cases.

11. 11

    Add AI-suggested test cases

    Review the AI-suggested scenarios and add the ones that should be included.

12. 12

    Modify test cases

    Adjust test case details, expected status code and response, priority, parameters, assertions, or any other test condition.

13. 13

    Execute an individual test case

    Verify API behavior and expected results before finalizing the whole suite.

14. 14

    Finalize and save the test suite

    Once test cases, assertions, and validations are reviewed and configured, save the suite.

15. 15

    Execute the test suite

    Run the complete suite against the selected environment — OptraFlow executes every selected test case and applies the configured validations to each response.

Test case categories

Test Suite can generate test cases covering multiple functional and non-functional scenarios.

Functional testing

• Positive, negative, and edge test cases
• Semantic validation — invalid data types, empty values, null values
• Request body validation — missing fields, duplicate values, email validation, invalid date formats, non-English characters
• Invalid headers, and token/authentication validation
• Business rule validation and information disclosure

Security testing

Security-related scenarios identify potential API security issues, including authentication, authorization, information disclosure, and invalid or manipulated inputs.

Non-functional testing

• Performance validation
• Response-time validation
• Security validation
• Rate-limit validation

Assertions and post-execution validation

Test Suite supports post-execution response validation through assertions. Assertions let you define what should be present or expected in an API response, and automatically verify those conditions after the API is executed. For example, if an API returns an amount field, you can assert that the amount is not zero.

1. System-suggested assertions

The system analyzes the API response and suggests relevant assertions based on the response structure and field types.

• Field Exists — verify that a field exists in the response.
• Data Type — verify that the field contains the expected data type.
• Equals Value — verify that the field exactly matches the expected value.
• Contains — verify that a field or response contains a specific value or text.

2. Manual assertions

Add assertions manually for specific fields in the response. Available options depend on the field type — for example, a numeric field like amount can be asserted to equal, exceed, fall below, or simply not equal a value. For array responses, assertions can also target values within the array.

{
  "products": [
    { "name": "Product A", "amount": 250 },
    { "name": "Product B", "amount": 500 }
  ]
}

A manual assertion here could require that amount is not zero for every product — applying the validation to every value within a complex response structure.

3. General assertions

General assertions apply to the entire API response rather than a specific field.

• Response Time — the response returns within the expected time.
• Payload Size — the response payload size is within the expected limit.
• Status Code — the API returns the expected HTTP status code.
• Contains Text — the response contains specific text.
• Contains Static Value — the response contains a predefined value.
• Contains Dynamic Value — the response contains a dynamically generated value.
• Contains Extracted Variable — the response contains a value extracted from a previous request or response.

Assertion Manager

A centralized place to manage assertions for a test case or test suite. You can review system-generated assertions, select suggested assertions, add manual and general assertions, configure expected values and conditions, and remove, modify, or toggle which assertions run. After the API response is received, selected assertions are evaluated automatically — for failures, the execution result shows the expected and actual values.

OpenAPI schema validation

When an API is sourced from an OpenAPI specification, Test Suite can validate the actual API response against the corresponding OpenAPI response schema — ensuring the response conforms to the defined API contract.

• Required fields
• Missing fields
• Data types
• Object structure
• Array structure
• Nested objects
• Enum values
• Nullable fields
• Schema-defined constraints
• Other applicable OpenAPI schema rules

{
  "id": "integer",
  "name": "string",
  "active": "boolean"
}

Schema validation vs. assertions

Business rule validation

Test Suite also supports validation of custom business rules. For example, a business rule required for a POST or PUT API can be configured through the Request Builder and validated as part of test execution.

1. When a business rule is added or updated, the affected test cases are identified.
2. Test cases are updated based on the new or modified rule.
3. Users review the updated test cases.
4. Users select the required test cases.
5. Selected test cases are executed to verify compliance with the business rule.

This keeps test suites aligned with changing API behavior and business requirements.

Test execution and results

After execution, Test Suite provides results for every executed test case, including passed and failed cases, assertion results, schema validation results, expected vs. actual values, response details, response time, payload information, and failure details.

You can execute individual test cases, a selection of test cases, test cases filtered by category or type, or the complete test suite.

Execution history

• Review previous executions.
• Identify recurring failures.
• Compare execution results.
• Investigate failed test cases.
• Track API validation over time.

Reports and sharing

After execution, review overall test suite results and share them with your team. Execution reports cover overall test status, passed/failed cases, assertion failures, schema validation failures, API response details, and performance- and security-related results — a single view of API quality that helps teams catch issues before changes ship.

End-to-end test suite flow

1. Create test suite
2. Select environment
3. Configure authentication / token reuse
4. Configure pre-request API
5. Select API
6. Generate test cases
7. Review & categorize test cases
8. AI review
9. Add AI-suggested test cases
10. Configure assertions
11. Configure OpenAPI schema validation
12. Configure business rules
13. Select / filter test cases
14. Execute individual test cases
15. Finalize & save test suite
16. Execute test suite
17. Post-execution validation
18. Review results & failures
19. View execution history
20. Generate / share results

In short

Test Suite validates four key aspects of an API — kept as distinct concepts deliberately, since separating contract, behavior, business logic, and quality validation is what makes results easy to interpret.