{
 "schema_version": 1,
 "generated": "2026-10-24",
 "id": "usestrix-strix--test-api-from-openapi-spec",
 "repo": "usestrix/strix",
 "repo_url": "https://github.com/usestrix/strix",
 "repo_slug": "usestrix-strix",
 "title": "Test every API endpoint from its OpenAPI spec",
 "page_title": "How to test every API endpoint from its OpenAPI spec with Strix",
 "summary": "Give Strix an OpenAPI, Swagger, or Postman file plus the live base URL to test all declared endpoints.",
 "who": "A backend engineer who maintains a documented API and wants coverage of every endpoint, not only the ones a crawler finds.",
 "problem": "Crawling an API misses endpoints that are declared but not linked from any page.",
 "outcome": "A test run that covers every declared endpoint in the contract against the live base URL.",
 "steps": [
  "Export your API contract as an OpenAPI or Swagger file, or a Postman export.",
  "Run `export STRIX_LLM=\"openrouter/z-ai/glm-5.3\"` and `export LLM_API_KEY=\"your-api-key\"`",
  "Run `strix --target ./openapi.yaml --target https://api.your-app.com`",
  "Review the findings for broken authentication, mass assignment, and rate limiting bypass."
 ],
 "agent_prompt": "Use the usestrix/strix repo to test the API described by <path-to-openapi-file> against <api-base-url>, running `strix --target <path-to-openapi-file> --target <api-base-url>`. Report the findings by endpoint. Verify that each finding names the endpoint it came from.",
 "agents": [
  "any"
 ],
 "difficulty": "Intermediate",
 "time": "30 minutes",
 "basis": "readme",
 "caveat": "The README says the spec tells Strix which endpoints to test, but it does not say how it handles endpoints missing from the spec.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "python",
 "requirements": [
  "Docker installed and running",
  "An LLM API key from a supported provider, or a ChatGPT Plus/Pro subscription sign-in",
  "The application source directory or a target URL you are authorized to test",
  "A GitHub repository with Actions enabled, if you want the CI workflow"
 ],
 "risk": "dual-use",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "credentials",
   "notice": "Testing a live API may use real account tokens or data, so use a staging environment you control."
  }
 ],
 "best": false,
 "score": 0.8,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/usestrix-strix/test-api-from-openapi-spec/",
 "md": "https://dedupedai.com/use-cases/usestrix-strix/test-api-from-openapi-spec/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/usestrix-strix--test-api-from-openapi-spec.json",
 "api_version": "v1"
}