What it does
Schemathesis is an open-source API testing tool that reads an OpenAPI or GraphQL schema, generates test requests, and checks responses for server errors and schema violations. Its CLI can chain related operations into multi-step workflows and emit reproduction commands for failures. The user supplies the schema and a reachable API instance to test.
Schemathesis is aimed at testing an API you own or are authorized to exercise, not at sending a harmless read-only probe by default. Start with a schema URL or local specification and point the runner to the target service. The documented example form is uvx schemathesis run ./openapi.yaml --url http://localhost:8000; it is illustrative here. The tool generates examples, boundary values, and randomized inputs, checks server errors, status codes, and response schemas, then reports failures with a reproducible request. A maintained OpenAPI or GraphQL schema is the key input. For authenticated APIs, add the appropriate credentials or token strategy; custom business rules can be added separately. Schemathesis also chains operations to exercise multi-step API workflows, so tests may send requests that create, change, or delete data. Use a disposable or otherwise safe development target and appropriate test credentials rather than pointing generated requests at production data. The CLI is an MIT-licensed open-source project. The project site also links to Workbench and TraceCov as separate tools; this listing covers the Schemathesis API-testing CLI and its documented integrations, not those other products.
Strengths
- Generates test inputs from an OpenAPI or GraphQL schema, including boundary and randomized values.
- Checks responses for server errors, status-code conformance, and schema violations, with reproduction commands for failures.
- Stateful workflows can chain API operations rather than testing each endpoint in isolation.
Watch out for
- The user must provide a useful API schema and a reachable test target; schema quality limits what the generated checks can exercise.
- Generated tests send real requests and may create, change, or delete target data, so the target and test credentials need deliberate scoping.
Best for
- Property-based and schema-conformance tests for APIs described by OpenAPI or GraphQL
- Finding edge cases across multi-step API workflows before changes reach production
Sources
- Schemathesis | API Testing for OpenAPI and GraphQL (Oct 25, 2026)
- Quick Start Guide - Schemathesis (Oct 25, 2026)
- Schemathesis — official repository README (Oct 25, 2026)
- LICENSE — schemathesis/schemathesis (Oct 25, 2026)