API Testing

Introduction

What is API Testing?

The API Testing screen is a complete HTTP client built directly into Testver. From a single page you can compose a request (method, URL, query parameters, headers, body, and authentication), press Send, and inspect everything that comes back — the status code, how long it took, how big the payload was, the response body, the response headers, and any assertions you attached to it.

If you have ever used Postman, Insomnia, or Thunder Client, this screen will feel immediately familiar. You keep your requests in named collections, group them into folders, switch between environments (for example Dev vs. Staging vs. Production) without rewriting URLs, and re-run earlier requests from a History drawer. Testver adds two things classic clients do not: a one-click Validate workflow that turns any value in a JSON response into an assertion, and a Generate Test button that asks AI to scan your project and write real, framework-native API test code for the requests you select.

Note

In one sentence: the API Testing screen is Postman living inside Testver — you build and send real HTTP requests, assert on the responses, and optionally let AI turn those requests into automated test code in your own project.

Who this guide is for

This guide is written for everyday users of the screen — QA engineers, developers, and testers who want to exercise an API by hand, save those requests, and validate the results. No prior Postman experience is assumed, but a working knowledge of HTTP (what a GET versus a POST is, what a header or a JSON body looks like) will help you move faster.

• Manual API testers who want to fire requests at an endpoint and eyeball the response.
• QA engineers who want to attach assertions to responses and re-run them as regression checks.
• Developers importing an existing OpenAPI/Swagger or Postman spec and trying it out instantly.
• Anyone building a test suite who wants AI to turn a set of requests into real test code in their project.

Key terms

These are the core concepts you will meet throughout the screen. Skim the table now and refer back to it as the terms come up.

Term	What it means in Testver
Request	A single HTTP call you compose: a method, a URL, optional query params, headers, a body, and authentication. The basic unit of work on this screen.
Method	The HTTP verb. Testver supports GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS, each shown in its own colour throughout the UI.
Endpoint	The address the request is sent to — the full URL, e.g. https://api.example.com/users, or a templated form like {{baseUrl}}/users.
Header	A name/value pair sent with the request (e.g. Content-Type: application/json). Edited on the Headers tab as a checkbox-toggled key/value list.
Body	The payload sent with the request. Types available: None, JSON, Text, Form Data (with file upload), and GraphQL (query + variables).
Auth	Authentication applied to the request. Types: None, Bearer Token, Basic Auth, and API Key (sent in a header or query param).
Collection	A named container that holds requests, folders, and environments. Your top-level unit of organization in the left sidebar.
Folder	A group of requests inside a collection. A folder can also be run end-to-end as a chain.
Environment / Variable	A named set of key = value pairs (e.g. an environment called Dev with baseUrl = https://dev.api…). Reference a variable anywhere with {{variableName}}; it is resolved when the request is sent.
Assertion (Validation)	A rule checked against the response — e.g. status equals 200, a JSON path equals a value, response time is under a threshold. Shown as pass/fail after sending.
Chain	Running a whole folder of requests in order, passing extracted variables forward, so a login response can feed the next request’s token.

How it works

The screen is laid out in two columns. On the left is the Collections sidebar — your saved requests, folders, and the buttons to create or import them. On the right is the workspace, split into two stacked panes: the Request Builder on top (where you compose the call) and the Response Viewer on the bottom (where the result appears). A toolbar across the top holds Import, Export, the environment switcher, Generate Test, and History.

1. Pick or create a collection in the left sidebar, then select (or add) a request inside it.
2. In the Request Builder, set the method, type the URL, and fill in any params, headers, body, or auth.
3. Optionally pick an environment from the toolbar so {{variables}} in your URL and fields resolve.
4. Press Send. The Response Viewer fills in with the status, timing, size, and body.
5. Add validations (by hand or by clicking values in the response), and re-send to see pass/fail.
6. When you are happy, the request auto-saves to its collection; optionally run a folder as a chain, or use Generate Test to produce automated test code.

Tip

Both the divider between the sidebar and the workspace, and the divider between the Request Builder and Response Viewer, are draggable — resize the panes to suit a large JSON body or a long list of requests. You can also collapse the sidebar entirely with the panel button at the far left of the header.

Getting Started

Opening API Testing

1. From the Testver navigation, open the API Testing screen (route /api-testing).
2. If you have no collections yet, the sidebar shows No collections yet with a Create one link.
3. Click Create one (or the + icon in the Collections header), type a name, and press Enter or the green check.
4. Click your new collection to expand it, then click + Request to start composing.
5. Type a URL into the address bar of the Request Builder and press Send (or hit Enter in the URL field).

Note

You can also start from scratch without any collection at all: a blank New Request is loaded by default. You can set a URL and Send immediately — you simply will not have a place to save it until you select a collection.

The screen layout

Everything on the screen falls into one of these regions.

Region	Location	What lives there
Header toolbar	Top, full width	Sidebar collapse toggle, API Testing title, and the action buttons: Import, Export, environment switcher, Generate Test, History.
Collections sidebar	Left column	The collection/folder/request tree, plus Import and New Collection (+) buttons in its header.
Request Builder	Top of the workspace (right)	Request name, method dropdown, URL bar, Send button, and the Params / Headers / Body / Auth / Validations / Scripts tabs.
Response Viewer	Bottom of the workspace (right)	Status/time/size bar plus the Body / Headers / Validations / Variables / Timing tabs.
History drawer	Slides in from the right	Past requests with their status and timing; click one to reload it. Opened with the History button.
Modals	Centered overlays	Import, Manage Environments, Generate Test, Chain Runner, and Quick Validate each open as a focused dialog.

At a glance

• Send a request — set method + URL in the Request Builder, press Send (or Enter in the URL bar).
• Save a request — happens automatically after a successful Send while a collection is selected; the request name also saves when you click away from it.
• Switch environment — use the Globe dropdown in the toolbar; your choice is remembered per collection.
• Validate a response — click Validate in the response status bar and click any JSON value to turn it into a rule.
• Re-run an old call — open History and click an entry.
• Run a whole folder — hover a folder and click the Play icon to open the Chain Runner.
• Make tests — click Generate Test, pick requests, and let AI write the code.

Collections & Requests

The collections tree

The left sidebar is a three-level tree: collections contain folders and requests, and folders contain more requests. The header reads COLLECTIONS and carries two icons — an Import (file-up) button and a + to create a new collection.

Each collection row shows a chevron (expand/collapse), a folder icon, the collection name, and a count of how many requests it holds. Click a collection to select and expand it. Each request row shows a drag handle, the method abbreviated to three letters in its method colour, and the request name (falling back to its URL, then to Untitled).

Action	How to do it
Create a collection	Click + in the Collections header (or Create one when empty), type a name, press Enter or the green check. Press Escape or the red X to cancel.
Rename a collection	Double-click its name, or hover and click the pencil icon. Edit and press Enter (or click away) to save.
Delete a collection	Hover and click the trash icon. A confirmation dialog warns that all folders, requests, and environments will be permanently deleted.
Add a folder	Expand the collection and click + Folder, type a name, confirm with the green check.
Rename / delete a folder	Double-click or use the pencil icon to rename; use the trash icon to delete (warns all requests inside are removed).
Add a request	Click + Request at the collection root or inside a folder. A blank GET request opens in the builder.
Duplicate a request	Hover the request and click the copy icon. A clone named “<name> (Copy)” is created in the same place.
Delete a request	Hover the request and click the trash icon, then confirm.
Run a folder as a chain	Hover a folder and click the Play icon (enabled only when the folder has at least one request).

Reordering & moving requests

Requests can be reordered and moved by dragging. Grab a request by its handle and drag it: drop it onto a folder header to move it into that folder, drop it between two requests to reorder, or — when dragging out of a folder — drop it on the dashed Drop here for root level zone to move it to the collection root. A coloured line or highlight shows where it will land.

Tip

Moving and reordering save in the background. A toast such as “Reordered …”, “Moved … to folder”, or “Moved … to root” confirms the change; the tree refreshes a moment later without a flicker.

Importing collections

The Import button (top toolbar, also in the sidebar header) opens the Import API Collection wizard. It accepts a .json file (click the drop area to browse) or pasted JSON. Testver auto-detects the format and shows a green Detected: … banner.

Supported format	How it is recognized
OpenAPI 3.x	JSON containing an openapi field.
Swagger 2.x	JSON containing a swagger field.
Postman Collection v2.1	JSON containing both info and item fields.
Native (Testver export)	JSON containing both id and requests fields.

The wizard walks through four visible steps — Upload → Select → Preview → Import:

1. Upload — drop or paste your spec; Testver detects the format. Click Parse.
2. Select — endpoints are grouped by folder/tag with checkboxes. Use Select All / Deselect All, and tick exactly the endpoints you want. Optionally enable AI Generate Scenarios to have AI build meaningful multi-step test flows from the selected endpoints.
3. Preview — review the folders and requests that will be created, including any [AI] scenario folders and the insights the AI produced.
4. Import — confirm the Collection Name and Base URL, review the endpoint/folder counts, and click Import Collection.

Note

On import, if a Base URL is provided Testver auto-creates a Dev environment containing a baseUrl variable and activates it for the new collection. If the Base URL looks like a relative path (it does not start with http), the wizard warns you to add the full hostname.

Caution

AI scenario generation streams over a WebSocket and can take up to two minutes. If it times out, errors, or returns an unparseable response, the wizard shows a notice and proceeds with your originally selected endpoints — nothing is lost.

Exporting collections

The Export button (top toolbar) opens a small menu with two choices: Export Collection (downloads only the currently selected collection, by name) and Export All Collections (“Backup everything”). Exports are downloaded as JSON in Testver’s native format, which can be re-imported later.

Building a Request

The Request Builder is the top pane of the workspace. At its very top is an editable request name field — type a friendly name; it auto-saves when you click away. Below it sits the URL bar, and below that the six tabs: Params, Headers, Body, Auth, Validations, and Scripts. Each tab that has content shows a small count badge.

Choosing the method

The method dropdown sits at the left of the URL bar and is colour-coded throughout the app. Pick the verb that matches the operation.

Method	Colour	Typical use
GET	Emerald/green	Read/retrieve a resource. No body.
POST	Blue	Create a resource or submit data. Usually has a body.
PUT	Amber	Replace a resource entirely.
PATCH	Brand/violet	Partially update a resource.
DELETE	Red	Remove a resource.
HEAD	Purple	Like GET but headers only, no body.
OPTIONS	Gray	Discover allowed methods / CORS pre-flight.

Entering the URL

Type the endpoint into the address bar. You can enter a full URL like https://api.example.com/endpoint or a templated one like {{baseUrl}}/path that uses environment variables. Press Enter in this field to send the request (the same as clicking Send).

Tip

When your URL contains {{variables}} and an environment is active, a green resolved URL preview line appears just under the URL bar, showing exactly what address will be called once variables are substituted. Any variable it cannot resolve is left as {{name}} so you can spot a typo.

Query parameters

The Params tab is a checkbox-toggled key/value list. Each row has an enable checkbox, a key field, a value field, and a delete (trash) button that appears on hover. Click Add to append a row. Only rows that are enabled and have a key are counted in the tab badge and sent with the request.

Headers

The Headers tab uses the same key/value editor as Params, with placeholders Header name and Header value. Add headers such as Content-Type or Accept, toggle them on/off with the checkbox, and remove them with the trash button. The badge counts enabled, named headers.

Authentication

The Auth tab offers four authentication types, selected with the row of buttons at the top. The fields below change to match. Any field accepts {{variables}}, so you can keep secrets in an environment rather than typing them inline.

Auth type	Fields	What it does
None	—	No authentication is applied.
Bearer Token	Token	Sends an Authorization: Bearer <token> header. Accepts a literal token or {{variable}}.
Basic Auth	Username, Password	Sends HTTP Basic credentials. The password field is masked.
API Key	Key Name, Key Value, Add to	Sends an API key under a name you choose (e.g. X-API-Key), placed either in a Header or as a Query Param via the Add to toggle.

Request body

The Body tab lets you pick a body type with the button row, then edit the payload below. The type buttons are None, JSON, Text, Form Data, and GraphQL.

Body type	Editor	Notes
None	No editor — “No body content”.	Use for GET and other bodyless requests.
JSON	Full code editor (Monaco) with JSON syntax highlighting, folding, and bracket colouring.	The recommended way to send a JSON payload; theme follows your app theme.
Text	Plain monospace textarea.	Send raw text as-is.
Form Data	A multipart editor with per-row Text / File toggle (see below).	Send multipart/form-data with text fields and file uploads.
GraphQL	Two textareas: Query and Variables.	Compose a GraphQL query plus a JSON variables block.

Form Data fields are powerful: each row has an enable checkbox, a Type toggle that switches the field between Text and File, a key (field name), and a value. For a File field, click Choose File to pick a file; its name and human-readable size are shown, and a small X clears it. Add rows with the + Text Field and + File Field buttons at the bottom.

Sending the request

Press the Send button (or Enter in the URL bar). The button is disabled while a request is in flight or while the URL is empty, and shows a spinner labelled Send while working. If you press Send with no URL, a toast reminds you to enter one.

Note

After a successful Send, if a collection is selected, the request is automatically saved into that collection (and folder). You do not need a separate Save step — though renaming the request also saves it when you click away from the name field.

The Response Viewer

The bottom pane fills in after you Send. Before any request it reads “Send a request to see the response”; during a request it shows a spinner with “Sending request…”. Once a response arrives you get a status bar and five tabs.

Status, timing & size

Across the top of the Response Viewer you see, at a glance: the status code and text in a colour-coded pill, the duration in milliseconds (clock icon), and the response size in human-readable bytes/KB/MB (disk icon). When the response is JSON, two action buttons also appear at the right — Extract and Validate.

Status range	Colour	Meaning
200–299	Emerald/green	Success.
300–399	Blue	Redirection.
400–499	Amber	Client error (bad request, unauthorized, not found, …).
500+	Red	Server error.
0 / other	Gray	No response / connection error.

The Body tab

The Body tab renders the response in a read-only code editor (Monaco). JSON is automatically pretty-printed and highlighted; content starting with < is treated as HTML; everything else is shown as plain text. Line numbers, folding, word-wrap, and bracket colouring are on. Hover the body to reveal overlay Copy and (for JSON) Download buttons in the top-right corner — Download saves the body as a .json file.

The Headers tab

The Headers tab lists every response header as a two-column table (name on the left, value on the right, value shown monospaced). The tab label includes the header count, e.g. Headers (12).

Working with JSON responses

When the body is JSON, two response-driven workflows become available from the status-bar buttons:

• Validate — turns the body into a clickable JSON tree. Click any value and Testver creates a body-json-path validation rule for it, pre-filling a sensible operator and the value as the expected result. The rule lands on the request’s Validations tab.
• Extract — also shows the clickable tree, but clicking a value sets it up to be saved as a variable. Testver auto-suggests a variable name from the JSON path; confirm or edit the name and click Add. This appends a set(...) line to your Post-Response Script so the value can flow into later requests.

The Validations tab

The Validations tab shows the result of every assertion after a Send. A summary line totals how many passed and failed, and each rule is rendered as a pass (green) or fail (red) card with its Type, Target (if any), the Rule (operator + expected), the Actual value returned, and any Info message. The tab badge shows a passed/total ratio, e.g. Validations (3/4). If no rules are configured, it points you to the Validate button.

The Variables tab

The Variables tab lists the variables in scope. Predefined Variables are the ones coming from the active environment (and the collection’s baseUrl), each shown as {{key}} = value with a copy-reference button. Extracted Variables (shown in cyan) are values pulled from the most recent response. A footer reminds you that {{variableName}} can be used in URLs, headers, body, and auth fields, and is resolved at send time.

The Timing tab

The Timing tab shows three figures: Total Duration (ms), Response Size, and the Timestamp of when the response was received, formatted in your local time.

Authoring validations

Besides clicking values in the response, you can author rules directly on the request’s Validations tab in the Request Builder. Click Add Validation for a blank rule, or Quick Add from Response to open the JSON picker. Each rule row has an enable checkbox, a type dropdown, an optional target, an operator, and an expected value.

Rule type	Target needed?	Checks
Status Code	No	The HTTP status (e.g. equals 200).
Header	Yes — header name	A specific response header’s value.
Body Contains	No	Whether the raw body contains/omits a string.
JSON Path	Yes — e.g. $.data.id	A value at a JSON path in the body.
Response Time	No	The duration (e.g. less-than a threshold).
JSON Schema	No (uses a schema block)	Validates the body against a JSON Schema you paste in.

Operator	Symbol / label
equals	=
not-equals	!=
contains	contains
not-contains	!contains
greater-than	>
less-than	<
exists	exists
matches-regex	regex

Pre-request & post-response scripts

The Scripts tab lets you run small snippets before a request is sent and after a response is received. There is a Quick Extract Variable shortcut at the top (give a name and a JSON path, click Add, and a set(...) line is appended to the post-response script), plus collapsible Pre-Request Script and Post-Response Script editors. A Script DSL Reference panel documents the available functions.

Function	Purpose
get(key)	Read a chain variable.
set(key, value)	Store a chain variable for subsequent requests.
jsonpath(body, path)	Extract a value from a JSON body using a path like $.data.id.
setHeader(name, value)	Set or override a header for the current request (pre-request only).

// Post-Response Script (on the login request):
set("token", jsonpath(response.body, "$.access_token"))

// Pre-Request Script (on the next request):
setHeader("Authorization", "Bearer " + get("token"))

Environments, Variables & Chaining

Selecting an environment

When a collection is selected, a Globe dropdown appears in the toolbar. It lists No Environment plus every environment in the collection (each with a count of enabled variables). The active environment turns the button green and its name is shown. Your selection is remembered per collection, so switching collections restores the environment you last used there.

1. Open the Globe dropdown in the top toolbar.
2. Pick an environment (e.g. Dev) — a check mark shows the active one.
3. All {{variables}} in your requests now resolve against that environment when you Send.
4. Choose No Environment to clear it, or Manage Environments… to edit them.

Managing environments

Manage Environments… (in the Globe dropdown) opens the environment editor. The left rail lists environments — each with a radio button to make it active, a variable count, and a delete (trash) button. Create a new one by typing in the New environment… box and pressing Enter; duplicate the current one with Duplicate.

On the right is the variable table. Each variable has an enable checkbox, a Variable Name (key), a Value, a secret toggle (eye / eye-off — masks the value), a copy reference button (copies {{key}}), and a delete button. Click Add Variable to add a row, then Save. A row of Available Variables chips at the bottom lets you copy any {{key}} with one click.

Tip

Reference a variable anywhere a value is accepted — URL, headers, body, and auth fields — with the {{variableName}} syntax, e.g. {{baseUrl}}/api/users. The collection’s own baseUrl is always available as a {{baseUrl}} fallback even without an environment selected.

Caution

Marking a variable secret only masks it in the UI (it switches the value field to a password input). It does not encrypt the value in storage — treat it as a convenience for shoulder-surfing, not a vault.

Running a folder as a chain

A folder can be run as a chain — every request in it, in order, with variables flowing forward. Hover the folder in the sidebar and click the Play icon (enabled only when the folder has requests) to open the Chain Runner dialog.

1. Hover the folder and click Play to open the Chain Runner. It lists the requests in order, with arrows between them.
2. Click Run Chain. Each step runs in sequence; a spinner marks the in-flight step and check/X marks completed ones.
3. When done you get a summary — how many passed, how many failed, and the total time.
4. Click any step to expand it: resolved URL, request headers/body, response status/headers/body, validations, and extracted variables.
5. Open the Variables panel to see the runtime variables, with extracted badges on values produced during the run.

Note

Variables extracted in one step (via a post-response set(...)) become available to later steps in the same chain — this is how a login step’s token can authenticate the requests that follow. Response bodies in the step detail can be copied or downloaded as JSON.

Generating tests with AI

The Generate Test button (top toolbar, enabled once a collection is selected) hands a set of requests to AI, which scans your project, discovers your test framework, writes framework-native API test code, runs it, and self-heals if the tests fail.

1. Click Generate Test to open the dialog. Your currently open request is pre-selected.
2. Tick the requests and folders to include (folders have tri-state checkboxes; [AI] folders are flagged with a wand). Use Select All / Select None.
3. Optionally give the test a name (e.g. “Pet Store API CRUD tests”).
4. Click Generate Test. The dialog switches to a streaming view showing the AI’s progress, tool calls, and a self-healing attempt bar.
5. Approve any file-write permission prompts when asked. On completion you see a verdict — Test Created & Passed, Needs Manual Fix, or an error — plus a diff of the files that changed.
6. Use Back to Selection to try a different set, or Close to finish.

Note

If you sent the currently open request just before opening this dialog, its captured response is included as context for the AI, which helps it write more accurate assertions.

Common Tasks (How Do I…?)

I want to…	Do this
Send a one-off request	Type a URL in the Request Builder and press Send (or Enter).
Save a request permanently	Select a collection first; after a successful Send it auto-saves there. Rename it by editing the name field.
Use a different server without rewriting URLs	Put the host in a {{baseUrl}} variable in an environment and switch environments from the Globe dropdown.
Add an auth token to a request	Open the Auth tab, pick Bearer Token, and paste the token (or reference a {{variable}}).
Send a JSON payload	Open the Body tab, choose JSON, and type into the code editor.
Upload a file	Body tab → Form Data → add a File Field → Choose File.
Assert the status is 200	Validations tab → Add Validation → type Status Code, operator =, expected 200.
Assert on a value in the JSON response	Send the request, then click Validate in the response bar and click the value in the tree.
Pass a login token into the next request	Extract it (response Extract button or a set(…) post-response script), then setHeader(“Authorization”, “Bearer ” + get(“token”)) in the next request’s pre-request script — and run them as a chain.
Re-run something I sent earlier	Open History and click the entry.
Run a whole folder end-to-end	Hover the folder → Play icon → Run Chain.
Import an OpenAPI / Postman spec	Import → upload or paste the JSON → select endpoints → Import Collection.
Back up everything	Export → Export All Collections.
Turn requests into automated test code	Generate Test → pick requests → Generate Test.

Tips & Best Practices

• Lean on environments. Keep hostnames, tokens, and IDs in environment variables and reference them with {{...}}. Switching from Dev to Staging then becomes one click instead of editing every URL.
• Watch the resolved-URL preview. When it appears under the URL bar, it shows exactly where the request will go — a fast way to catch an unset or misspelled variable (it stays as {{name}} if unresolved).
• Build assertions from the response. The Validate button is the quickest path to a rule — click the value you care about instead of hand-typing JSON paths.
• Name your requests. A clear name (not just a URL) makes the sidebar, History, and Chain Runner far easier to scan.
• Group related calls into folders so you can run them as a chain and so Generate Test can offer them as a set.
• Resize the panes. Drag the horizontal divider to give a big JSON response more room, or collapse the sidebar for a wider workspace.
• Export regularly. Use Export All Collections to keep a JSON backup you can re-import.
• Use secret masking for shared screens — toggle the eye-off on sensitive environment variables before screen-sharing.

Troubleshooting & FAQ

Symptom	Likely cause & fix
”Please enter a URL” toast on Send	The URL field is empty. Type an endpoint (full URL or {{baseUrl}}/path) and Send again.
My {{variable}} shows up literally in the resolved URL	No environment is selected, the variable is disabled, or its key is misspelled. Open the Globe dropdown to pick an environment, or Manage Environments to check the key.
The request did not save	Auto-save only happens when a collection is selected and the Send succeeded. Select a collection, then Send.
Validate / Extract buttons are missing	They only appear when the response body is valid JSON. A non-JSON body (HTML/text) shows the body but not these buttons.
Status shows 0 / gray pill	No response was received — a connection error, unreachable host, or DNS failure. Check the URL and that the server is up.
A validation fails unexpectedly	Open the Validations tab and compare Actual vs the Rule’s expected value; the operator or expected value may need adjusting (e.g. number vs string).
AI scenario import produced nothing	AI generation can time out (≈2 min) or return an unparseable response; the wizard then proceeds with your selected endpoints. Re-run with fewer endpoints, or import without the AI toggle.
Imported Base URL warning (amber)	The Base URL is a relative path. Edit it to include the full hostname, e.g. https://api.example.com.
Generate Test asks for permission	By design — the AI requests permission before creating or editing files in your project. Approve to let it write the test code.
Chain stopped early / a step is red	A step returned an error or a 4xx/5xx status. Expand that step to see the response and which validation failed, then fix the upstream request or variable.
History is empty	No requests have been sent yet in this session, or History was cleared with the trash icon. Send a request to populate it.
Can’t find the environment switcher	Select a collection first — the Globe dropdown only appears when a collection is active.

Related

• Test Plans — include API requests in execution cycles.
• AI Assistant → API mode — generate request chains in conversation.