- Home
- Fuzz Testing Software
- Schemathesis
Schemathesis
What it is
Schemathesis generates property-based tests from OpenAPI and GraphQL schemas to uncover API bugs. It creates cases around boundary values, type mismatches, and constraint violations, then checks responses against the OpenAPI specification. Stateful testing can chain operations into multi-step workflows using schema-inferred links. During execution, it learns validation rules, resource IDs, and authentication requirements from server responses and reuses them. Engineers can add Python checks for business rules alongside built-in checks. Supported specifications include OpenAPI 2.0, 3.0, 3.1, and 3.2, plus GraphQL schemas. Authentication supports Bearer tokens, Basic authentication, and API keys, with environment substitution and Python hooks for dynamic flows. Integrations include a GitHub Action, Docker image, pip or uvx installation, and pytest. Reports can be exported as JUnit, VCR, HAR, NDJSON, JSON, or Allure, and failures can be saved with curl commands for replay. Schemathesis is self-hosted, runs on Linux, macOS, and Windows, and is licensed under MIT. The free plan is free.
For and against
For
- Generates tests from OpenAPI and GraphQL
- Probes boundary and constraint cases
- Supports stateful multi-step workflows
- Integrates with GitHub Actions and pytest
- Exports multiple report formats
Against
- Python checks require Python
- Self-hosted deployment is required
- Technical support is directed to Discord
- Privacy policy cannot guarantee absolute security
The verdict
Schemathesis provides schema-based API testing with adaptive runs, custom Python checks, and CI/CD integrations. Its free MIT-licensed package supports broad OpenAPI versions, GraphQL, multiple authentication methods, and replayable failure output.
Who it suits
Schemathesis suits engineers testing OpenAPI or GraphQL APIs and incorporating checks into CI/CD. It is appropriate for teams wanting schema-driven, stateful, and customizable API testing.
Plans and prices
Schemathesis
Open-source API testing tool; generates tests from OpenAPI and GraphQL schemas
Read 4 Oct 2026 · schemathesis.io
On the record
- Adaptive testing
- During a run, it learns from server responses and reuses discovered validation rules, resource IDs, and authentication requirements.schemathesis.io · read 4 Oct 2026
- Authentication
- It supports Bearer tokens, Basic authentication, and API keys, with environment variable substitution and Python hooks for dynamic flows.schemathesis.io · read 4 Oct 2026
- Custom checks
- Users can add Python checks for business rules alongside built-in checks.schemathesis.io · read 4 Oct 2026
- Integrations
- The maker lists a GitHub Action, Docker image, pip or uvx installation, and pytest integration.schemathesis.io · read 4 Oct 2026
- Intended users
- The maker presents Schemathesis for engineers testing OpenAPI or GraphQL APIs and integrating API tests into CI/CD.schemathesis.io · read 4 Oct 2026
- License
- The project repository states that Schemathesis is licensed under the MIT license.github.com · read 4 Oct 2026
- Purpose
- Schemathesis generates property-based tests from OpenAPI and GraphQL schemas to find API bugs.schemathesis.io · read 4 Oct 2026
- Reports
- It can export JUnit, VCR, HAR, NDJSON, JSON, and Allure reports, and save failures with curl commands for replay.schemathesis.io · read 4 Oct 2026
- Response validation
- It validates API responses against the OpenAPI specification.schemathesis.io · read 4 Oct 2026
- Security and privacy
- The privacy policy says the company uses commercially acceptable means to protect personal data but cannot guarantee absolute security.schemathesis.io · read 4 Oct 2026
- Specifications
- It supports OpenAPI 2.0, 3.0, 3.1, and 3.2, plus GraphQL schemas.schemathesis.io · read 4 Oct 2026
- Stateful testing
- It chains API operations into multi-step workflows using links inferred from the schema.schemathesis.io · read 4 Oct 2026
- Support
- The maker directs users to Discord for technical support, configuration questions, bug reports, and integration examples.schemathesis.io · read 4 Oct 2026
- Test generation
- It generates cases that probe boundary values, type mismatches, and constraint violations.schemathesis.io · read 4 Oct 2026
