APITesting

APITesting

Two CLI tools for HTTP API testing: Hurl for declarative test workflows, httpx for fast concurrent probing.

Tool Selection

Multi-step API workflow, assertions, CI/CD   → Hurl
Request chaining, token capture, auth flows  → Hurl
Bulk URL probing, discovery, quick checks    → httpx
Status code scanning, tech detection         → httpx
Single ad-hoc request                        → just use curl
Browser rendering needed                     → Playwright
WebSocket / gRPC                             → specialized tools
Load testing                                 → k6 or artillery

Prerequisites

Before using either tool, verify installation:

which hurl httpx

---

Hurl — Declarative API Testing

Hurl runs HTTP requests from .hurl files — plain text, version-controllable, CI-friendly. Replaces Postman/Insomnia for automated API testing.

.hurl File Format

# Login and capture token
POST http://localhost:3000/api/login
Content-Type: application/json
{"email": "[email protected]", "password": "secret"}
HTTP 200
[Captures]
token: jsonpath "$.token"

# Use token for authenticated request
GET http://localhost:3000/api/profile
Authorization: Bearer {{token}}
HTTP 200
[Asserts]
jsonpath "$.email" == "[email protected]"
jsonpath "$.role" isString

Each entry: method + URL, optional headers/body, then expected status and assertions. Entries in the same file run sequentially — captured values carry forward.

Running Hurl

# Run a .hurl file
hurl --test api-tests.hurl

# With variables (swap hosts, credentials, etc.)
hurl --variable host=staging.example.com --test api-tests.hurl

# JSON report output
hurl --test --report-json report.json api-tests.hurl

# Run all .hurl files in a directory
hurl --test tests/*.hurl

Common Assertions

[Asserts]
jsonpath "$.id" exists
jsonpath "$.count" >= 1
jsonpath "$.items" count == 10
jsonpath "$.status" == "active"
header "Content-Type" contains "application/json"
duration < 2000

When to Use Hurl

• API contract testing in CI/CD pipelines
• Multi-step workflows (login, then authenticated requests)
• Request chaining with token/value capture
• Regression testing for REST APIs
• Smoke tests against staging/production

---

httpx — Fast HTTP Probing

httpx (by ProjectDiscovery) probes URLs concurrently with rich metadata extraction. Built for discovery and reconnaissance.

Core Commands

# Probe single URL with metadata
echo "https://example.com" | httpx -status-code -title -tech-detect

# Batch probe from file
httpx -l urls.txt -status-code -content-length -json -o results.json

# Follow redirects and show chain
echo "http://example.com" | httpx -follow-redirects -location

# Filter by status code
httpx -l urls.txt -mc 200,301 -json

Useful Flags

Flag	Purpose
-status-code	Show HTTP status
-title	Extract page title
-tech-detect	Detect technologies (Wappalyzer)
-content-length	Show response size
-json	JSON output
-o results.json	Write output to file
-mc 200,301	Match specific status codes
-fc 404,500	Filter out status codes
-follow-redirects	Follow redirect chains
-location	Show redirect destination
-l urls.txt	Read URLs from file
-threads 50	Concurrency (default 50)

When to Use httpx

• Bulk endpoint discovery and validation
• Quick health checks across many URLs
• Technology detection and fingerprinting
• Filtering live hosts from a URL list
• Pre-scan before deeper testing