Authors REST Assured (Java) API tests using the given().when().then() BDD-style DSL - status code + JSON/XML path assertions + authentication (Basic, OAuth2, API key). Configures Maven / Gradle dependencies, runs via JUnit 5, and emits Surefire / JaCoCo reports for CI gating. Use when the project is on the JVM and wants type-safe API tests in the app's own language; for a Gherkin feature-file flow on the same JVM use karate-testing, for YAML tests on the pytest stack use tavern-testing.
88
90%
Does it follow best practices?
Impact
88%
1.10xAverage score across 10 eval scenarios
Passed
No findings from the security scan
The policy service is a legacy system that answers in XML. Last Tuesday the
vendor upgraded their serializer. No field changed value, but the output is now
pretty-printed, empty elements come back self-closed, and attributes come out
in a different order. Nine of our tests went red immediately with
org.opentest4j.AssertionFailedError: expected: <true> but was: <false> and no
indication of which check failed - we had to add print statements to find out.
While fixing those we found something worse. underwritingDecisionIsApproved
has been passing for months regardless of the actual decision. The response
carries an <auditTrail> whose entries quote the decision text, so the string
we look for is in the document even when the policy was declined. We confirmed
it by pointing the test at a declined policy - still green.
PolicyServiceIT below is the five checks that matter, condensed from the nine.
The team's first instinct was to record a known-good response and compare
against it, which is what we already do for the orders API and which everyone
hates for the same reasons.
PolicyServiceIT so each check is tied to a specific place in the
document rather than to text appearing somewhere in it.APPROVED, regardless of what the audit trail contains.Out of scope: no new dependencies - work with what the module already has. Do not change the endpoint.
Extract the following files before beginning.
=============== FILE: src/test/java/com/example/policy/PolicyServiceIT.java =============== package com.example.policy;
import io.restassured.RestAssured; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.DisplayName; import org.junit.jupiter.api.Test;
import static io.restassured.RestAssured.given; import static org.junit.jupiter.api.Assertions.assertTrue;
class PolicyServiceIT {
private static String document;
@BeforeAll static void setup() { RestAssured.baseURI = System.getProperty("api.baseURI", "http://localhost:8080"); document = given(). auth().preemptive().basic(System.getenv("POLICY_USER"), System.getenv("POLICY_PASSWORD")). when(). get("/policies/POL-1001"). then(). statusCode(200). extract().asString(); }
@Test @DisplayName("the policy is active") void policyIsActive() { assertTrue(document.contains("ACTIVE")); }
@Test @DisplayName("the policy holder surname is correct") void holderSurname() { assertTrue(document.contains("Lovelace")); }
@Test @DisplayName("the coverage is comprehensive") void coverageType() { assertTrue(document.contains("type="COMPREHENSIVE"")); }
@Test @DisplayName("the coverage limit is five thousand euro") void coverageLimit() { assertTrue(document.contains("500000")); }
@Test @DisplayName("underwriting approved the policy") void underwritingDecisionIsApproved() { assertTrue(document.contains("APPROVED")); } }
=============== FILE: docs/policy-service-sample.xml =============== ACTIVE Ada Lovelace 500000 0 APPROVED uw.system
=============== FILE: pom.xml =============== 4.0.0 com.acme policy-api-tests 4.0.1-SNAPSHOT
21 UTF-8 io.rest-assured rest-assured 6.0.0 test org.junit.jupiter junit-jupiter 5.10.2 test maven-failsafe-plugin 3.2.5 integration-test verify