api-test-plan

# API Test Plan Skill APIs fail in specific, testable ways: wrong status codes, schema drift, missing auth checks, sloppy validation, unhelpful errors. This skill plans the tests that catch them — per endpoint, across the response codes and the error paths, with contract checks so the API keeps its promises to clients. It tests the whole behaviour, not just the happy `200`. ## Working from a brief Given an endpoint or an API description, **produce the test plan anyway** — infer the likely parameters, responses, auth model, and error cases, labelling assumptions. Always include auth, validation, and negative cases. Never hand back a question instead of a plan. ## Required Inputs Ask for these only if they aren't already provided (else infer and label): - **The API** — REST/GraphQL, the endpoints/operations, and what they do. - **Contract** — request/response schemas, parameters, status codes (or an OpenAPI/spec if available). - **Auth & rules** — the auth model (token/scopes/roles), rate limits, and validation rules. - **Dependencies & data** — downstream services, and the data/state needed to test. ## Output Format ### API Test Plan: [API / endpoint] **Per endpoint**, a set of cases grouped by type: | ID | Endpoint | Case | Type | Request | Expected status | Expected body / assertion | |---|---|---|---|---|---|---| | API-01 | POST /orders | valid create | Functional | valid payload | 201 | body matches schema, id returned | | API-02 | POST /orders | missing field | ...