ChatGPT Prompts for API Testing, with Worked Examples
API tests fail quietly when they only check the happy path. This prompt gives the AI an endpoint definition and asks for a scenario matrix that covers validation, status codes, auth, and data integrity — ready to turn into Postman, REST Assured, or Playwright API tests.
The prompt
Act as an SDET designing API tests. Endpoint: [METHOD] [PATH] Purpose: [what it does] Auth: [e.g. Bearer token, API key, none] Request body schema / example: [PASTE JSON OR SCHEMA] Business rules: [e.g. email must be unique, quantity 1-100] Documented responses: [e.g. 201, 400, 401, 409] Produce: 1. A test scenario table: ID, Scenario, Request change, Expected status, Expected response checks. 2. Cover: valid request, each required field missing, wrong data types, boundary values, duplicates, auth missing/expired/insufficient role, malformed JSON, unsupported method, and large payloads. 3. Response checks beyond status: schema, headers (Content-Type), no sensitive data leaked, error message format. 4. List side effects to verify (records created, idempotency, no partial writes). 5. Flag any behaviour the spec does not define as "UNDEFINED — confirm with developer". Do not claim any request has been executed. Output Markdown.
Replace every [BRACKETED] placeholder with your own details.
Sample input: create order endpoint
Fictional example written for this guide.
POST /api/v1/orders
Auth: Bearer token (role: customer)
Body:
{
"productId": "SKU-1042",
"quantity": 2,
"shippingAddressId": "addr_77"
}
Rules: quantity 1–20; productId must exist and be in stock; address must belong to the caller.
Documented responses: 201 Created, 400, 401, 403, 404, 422Sample AI output (illustrative, not executed)
Sample output only — this shows the shape of a good answer. It has not been run, executed, or verified against a real system.
| ID | Scenario | Request change | Expected status | Checks | | API-01 | Valid order | none | 201 | body has orderId, status="PENDING"; Location header present | | API-02 | Missing productId | remove field | 400 | error names productId | | API-03 | quantity = 0 | quantity: 0 | 400 or 422 | UNDEFINED — confirm which | | API-04 | quantity = 20 | quantity: 20 | 201 | upper boundary accepted | | API-05 | quantity = 21 | quantity: 21 | 422 | message mentions max 20 | | API-06 | quantity as string | "2" | 400 | type error, no order created | | API-07 | Unknown product | "SKU-0000" | 404 | no order created | | API-08 | Another user's address | other user's addr id | 403 | no address details leaked | | API-09 | No token | remove Authorization | 401 | WWW-Authenticate header | | API-10 | Expired token | expired JWT | 401 | no stack trace in body | | API-11 | Malformed JSON | trailing comma | 400 | Content-Type: application/json | Side effects: stock decremented only on 201; repeated identical POST does not double-charge if an Idempotency-Key is supported.
Status-code expectations at a glance
| Code | When you should expect it | What to also check |
|---|---|---|
| 200 / 201 | Valid read or successful create | Schema, Location header on 201, no extra fields |
| 204 | Successful delete or update with no body | Body is truly empty |
| 400 | Malformed JSON or wrong data type | Error points to the field |
| 401 | Missing, invalid, or expired credentials | No data in body; consistent message |
| 403 | Authenticated but not allowed | Does not reveal whether the resource exists |
| 404 | Resource does not exist | Same shape as other errors |
| 409 / 422 | Conflict or business-rule failure | Nothing partially saved |
| 429 | Rate limit exceeded | Retry-After header |
| 5xx | Should never be triggered by bad input | Log as a defect if it is |
Negative scenarios people often skip
- Extra unexpected fields in the body (mass-assignment risk)
- Null vs. empty string vs. missing field — three different cases
- Unicode, emoji, and very long strings in text fields
- Changing an ID in the path to another user's resource (IDOR)
- Sending the same request twice quickly (race conditions, duplicates)
- Wrong Content-Type header with a valid body
Authentication testing tips
- Test with no token, a malformed token, an expired token, and a token for a different role.
- Confirm that logging out or revoking a token actually blocks later requests.
- Check that error bodies for 401/403 never include stack traces or internal IDs.
- Use dedicated test accounts and test tokens — never real user credentials in prompts.
QA review before you use the output
- • Check every expected status against the API documentation; AI often guesses 400 vs 422.
- • Replace real tokens, keys, and internal URLs with placeholders before pasting a spec.
- • Run the tests yourself — the AI output is a plan, not evidence the API works.
- • AI output can be wrong or incomplete. A human tester owns the final result.
Related prompts
Need a different QA prompt?
Browse 50+ copy-ready prompts or build your own in seconds.