AutoRestTest reads your OpenAPI spec, works out which endpoints feed which, and generates request sequences that get deep into your API — instead of a thousand independent calls that all 400 on a missing ID.
Bring an OpenAPI 3.0 spec — or a zip of your source code. No test scripts to write.
GET /orders/{id} returned 500 when called with an order created moments earlier — the handler assumes a shipping address that POST /orders doesn't require.
Real APIs have order and state. Three things break testing that ignores them.
GET /orders/{id} never returns 200 until something created an order first. Tools that treat endpoints independently plateau at shallow coverage, and everything behind a create-then-read wall goes untested.
You can wire the fixtures up yourself, but every new endpoint means working out again which call has to come first — and the wiring breaks the next time the schema moves.
A body can satisfy the schema and still be rejected when email is "string" and currency is "aaa". Coverage stalls out on 400s that were never bugs in the first place.
Upload an OpenAPI 3.0 spec, or a zip of your source and let AutoRestTest derive one. Set a target URL, a time budget, and any auth headers.
Every operation is linked to the ones whose responses can fill its parameters — a semantic dependency graph of your API, built from the spec.
Q-learning agents explore that graph while an LLM generates realistic values, learning which sequences and parameters actually get past your validation.
Coverage, pass rate, and status codes per operation — with every server error called out and explained in plain language.
Covered vs. total endpoints, pass rate across every generated test case, and a status-code breakdown per operation — not one number for the whole API.
5xx responses are flagged separately from 4xx. A 400 is usually the test's fault. A 500 is usually yours, and those are the ones worth your morning.
Every failing endpoint gets a written explanation of what actually went wrong, generated from its real responses — not a stack trace to decode.
Explore the graph in the app, with what the agents learned during the run layered over it, so you can see which paths paid off and which were dead ends.
Set a time budget, dial fault-injection up or down, pass custom auth headers, and exclude any endpoint you don't want called.
Projects with roles and invitations, so specs, runs, and reports live somewhere your whole team can read them.