API Spector
API Spector is an Open Source API client designed for local use, file based with Git as the main project sharing mechanism. Rather than have a separate CI 'runner' API Spector can operate as a GUI or directly in CI. Highly Capable and fast evolving client.
About API Spector
API Spector is an Open Source API client. This is completely free with no extra paid features, login requirements or telemetry.
API Spector can be found at:
API Spector changes every time I look at it, so I check the main page for updates and I tend to update it prior to usage:
npm update -g @testsmith/api-spector
Benefits of API Spector
I find API Spector to be easy to use. API Spector focuses on making it easy to interact with an API.
API Spector seems to be able to import almost every competing tool collection: Postman, Insomnia, Bruno, HTTP file and OpenAPI (json or yaml). I primarily work from OpenAPI.
Easy to use contract and validation building capabilities.
Built in fuzzing for sending malformed payloads.
Best API client for checking your OpenAPI specifications and standards compliance.
Quick Review Criteria
| Feature | Y/N | Comment |
|---|---|---|
| Essential | ||
| Send HTTP or HTTPS requests | Y | |
| View the actual requests and responses | Y | Seen in the history views |
| Proxy support | Y | |
| Can create invalid requests | Y | |
| Optional | ||
| Read Open API files | Y | Also populates Environment host variables |
| Supports global environment variables e.g. for host | Y | With syntax highlighting and linting |
| Different payload body types | Y | |
| Easy to add headers | Y | |
| - custom headers | Y | |
| - auth header support | Y | |
| - override body type headers | Y | It is possible to edit as JSON and set content-type header to XML |
| Variables in headers | Y | |
| Custom Verb support | N | GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD, QUERY |
| Repeating or cloning earlier requests | N | Can clone requests in collection but not adhoc repeat |
| View history of requests/responses | Y | can export history to HAR file |
| Exporting requests to cURL format | N | |
| Sends Diagnostic information to server | N | Does not seem to send diagnostic information |
| Bonus | ||
| Data driven requests | N | But it has built in fuzzing and can use faker |
| Output log of test sessions | Y | as HAR file |
| Scriptable for customisation | Y | At Collection and Request level |
| Importing cURL requests | Y | When creating a request can import cURL |
| Free for commercial use | Y | free - no paid plan |
API Spector met all my basic needs.
For Exploratory Testing it has some unique features:
- fuzzing to generate erroneous payloads makes it easy to generate a bunch of quick stress requests
- tabs validate responses against HTTP standards to show issues with the response
For people who like to automate in the REST Client, the collection can be 'run' and all schema validation and javascript validation can be run.
Responses can be turned into 'contracts' which future responses are then validated against - API Spector creates default contracts from the Open API spec you imported and this is a good way to validate your Open API spec.
I've found more errors with my OpenAPI files and API headers using API Spector than with any other tool I've used before.
Notes on Usage
API Spector saves all the collection files in a folder. This makes it easy to review and manage in version control.
API Spector provides direct GIT integration but I prefer to manage the Collection versioning using Git directly.
API Spector makes the version control easy by keeping all data in simple files, and multiple files are used rather than a single database file or large JSON or XML file.
The Payload body editor uses the syntax of the payload type selected e.g. JSON payloads are colour coded and syntax checked. The payload can also be pretty-printed using the format text so you don't have to worry about formatting when editing.
The editor did not prevent me from sending through invalid payloads. i.e. the payload was shown as invalid in the UI but still sent through to the server which is exactly what I want.
Headers are easy to add. Code completion on Headers is available for the key and the value. This does not prevent you from creating invalid header keys or values (which is exactly what you want when testing).
Multiple authentication types are supported by the UI making it easy to add Bearer tokens or API keys. These can also be added directly through the Header amendment and can use values in variables.
- Bearer
- Basic
- Digest
- NTLM
- Custom API Key headers
- OAUTH 2
Variables can be created at multiple levels:
- Request
- Environment
- Collection
- Global
I tend to stick to Environment variables. But have experimented with Collection variables for random data.
API Spector supports Faker and this can be used to add random data into a payload.
This is the first API Client I've used which supports native Fuzzing to vary payload bodies and automatically send invalid and malformed requests.
It is also the first API Client that I've seen proactively validate requests against HTTP standards, and validate requests against the OpenAPI spec that was imported.
Summary - Fast Becoming My First Choice of APi Exploratory Testing Client
API Spector is becoming my default REST API tool. And is absolutely my first choice for testing standards compliance and response integrity.
I still jump to Bruno for adhoc testing but that is probably more about habit more than quality of tool.
I find API Spector:
- easy to use.
- reports errors better tan other tools
- plays well with other tools e.g. Proxies
- imports Open API files well and creates contracts from them
- helpful for error testing with the fuzzing capability
- the only tool I regularly add validation rules into because it is so easy to create from tree view and contract
- the only tool that exports HAR timelines for evidence
Highly recommend using API Spector if you are building APIs.