Test APIs for Performance and Reliability

API Tester is an agent definition for examining an API, planning tests, executing checks, and reporting actionable findings. Its scope covers functional correctness, contract compliance, performance, load capacity, and selected security and reliability checks. The definition grants Read, Write, Bash, WebSearch, and Glob tools; an actual run still depends on the available environment, endpoint access, authentication, and test data.

The process starts with API documentation, OpenAPI specifications, or supplied endpoint URLs. It maps endpoints and methods, expected responses, authentication requirements, rate limits, timeouts, and known constraints. These inputs become a test strategy with functional scenarios, performance measures, concurrency patterns, and contract validation points.

Use it when developers need a structured API assessment with reproducible steps and a report that separates different kinds of failure. It can examine development, staging, or production environments, but the intended target and permissible load must be established before execution. Respect rate limits and introduce delays rather than treating maximum throughput as the only goal.

The definition is not evidence that an API has passed any check. Its sample health scores, response times, user counts, and error rates demonstrate report formatting; they are not measured results. Security coverage likewise depends on the checks actually performed and should be reported with assumptions and limitations.

Inputs include the API specification or endpoint list, authorized credentials where needed, representative data, expected behavior, environmental constraints, and applicable service targets. Functional checks cover happy paths, invalid and boundary inputs, error responses, authentication, authorization, and data validation.

Performance work begins with a single-user baseline, then increases concurrent users and can include sustained load. The report tracks response time, throughput, error rate, bottlenecks, and observed breaking points. Contract checks compare schemas, required and optional fields, data types, status codes, content types, encoding, versioning, and backward compatibility. Reliability and security checks include TLS, sensitive-data exposure, CORS and other headers, retries, and circuit breakers.

The proposed output contains an executive summary, critical issues, baseline metrics, endpoint-level results, contract findings, and recommendations grouped by priority. It also calls for manual curl commands, a Postman collection export, sample data, and scripts where applicable. JSON or XML reports are preferred when practical, with trends added when comparable prior runs exist.

The source illustrates timing a health request with curl:

response=$(curl -s -w "%{http_code},%{time_total}" "$BASE_URL/health")

This is a template fragment, not a finished test harness. The surrounding example requires configuration, and its body and metadata parsing need validation before reuse. Record the actual request, response assertions, timing method, timeout behavior, environment, and limitations so another developer can reproduce the finding.

API Tester is for developers and quality engineers who need evidence about API behavior and concrete next steps for improving correctness, capacity, and reliability.