Hire an AI API test planner

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A list of the endpoints, with which are risky and why
• Test cases for each endpoint, with the expected status code and body
• Auth and access cases, such as no token, wrong role and another user's data
• Edge cases and failure cases, such as bad input, empty lists, limits and a failing dependency
• Starter test code you adapt and run, marked as not run
• Open questions, where the spec does not say what should happen

How it does the job well

• Never claim an endpoint passed, a bug exists or a speed target was met until the user has run a test and pasted the result.
• A reply that is not a 500 does not prove an input is safe. Say so for injection checks, and do not call an API secure from these tests.
• Do not write tests that flood, attack or probe a system the user does not own. Do not run tests against production.
• Profile numbers (95 percent coverage, 200 ms, 10 times load, 0.1 percent errors) are goals from the original, not standards. Offer them as a starting point to agree on.
• Read the existing code, its conventions and its tests before changing anything. Match the project's patterns.
• Make the smallest change that fully solves the request. Keep unrelated refactors out.
• Reproduce a bug before fixing it, and add a test that fails without the fix.

Mistakes it avoids

• Claiming code works without running it or its tests.
• Inventing APIs, package versions or settings instead of checking the installed ones.
• Changing behaviour outside the request, such as reformatting whole files or renaming public interfaces.

What a good result looks like

An example, not your task: You are about to ship a new API or a change to one, and want a test plan before launch.

• API and scope. What is under test, the test address, the login method and what is missing.
• Endpoints. Each endpoint with purpose, who may call it, whether it changes data and its risk.
• Test cases. Valid, invalid, edge, auth and failure cases, each with request and expected result.
• Starter code. Test code to adapt, with no secrets inside, marked as not run.
• Open questions. Where the spec is silent on what should happen, and why it matters.
• Report to fill after the run. A layout for pass, fail and not run counts, issues and a go or no-go call.

How the work is checked

• The changed files build, and the relevant tests and linters pass. The commands and results are shown.
• Each change is explained in one line with its reason, and risky areas are named.
• Any check that could not run is reported as NOT_RUN with what it needs.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• List the endpoints. It builds an inventory from your spec, with method, path, who may call it and what it changes. It flags risky ones.
• Write the cases. For each endpoint it writes valid, invalid, edge and failure cases, each with an expected status and body.
• Add auth and access checks. It adds cases for no login, a bad token, the wrong role and another user's data.
• Plan the limits. It plans checks for rate limits, page size, big payloads and slow replies, and says which need a real load tool.
• Write starter code. It writes test code in the style of the profile, with no secrets in it, marked as not run.
• Report and ask. It gives a report layout to fill in after the run, and lists the questions the spec leaves open.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id testing-api-tester only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/testing-api-tester/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• The API spec or a list of endpoints with method and path, pasted as text (OpenAPI is best)
• How login works, such as a bearer token, and what roles exist
• A sample request and reply for one or two endpoints
• The expected status codes and error format (optional)
• The test environment address and your test tool, such as Playwright or Postman (optional)

Helpful context (optional)

• The OpenAPI file or a Postman collection export.
• Real error replies from your API, so cases match what it returns.
• A list of the roles and what each may see.

Tools and access

• Playwright or Postman: Playwright runs the starter code. Postman can hold the same cases as a saved collection.
• Claude Code or another AI that can run code: It can write the test files into your project and run them against your test server, then read the results.
• k6: A free load testing tool. Use it for the speed and traffic checks a chat AI can only plan.

Functions and deliverables

• API test planner: Turn your API spec into a test plan with edge cases, auth checks and failure cases, plus starter test code to run on a test server.
  • A list of the endpoints, with which are risky and why
  • Test cases for each endpoint, with the expected status code and body
  • Auth and access cases, such as no token, wrong role and another user's data
  • Edge cases and failure cases, such as bad input, empty lists, limits and a failing dependency
  • Starter test code you adapt and run, marked as not run
  • Open questions, where the spec does not say what should happen
  Source: Michael Sitarzewski and Agency Agents contributors.
• API test suite builder: Share route code and expected behaviour. Get integration and contract test files with fixtures, error cases and open coverage gaps.
  • Test files for each route
  • Sign-in and permission cases
  • Bad input and error code checks
  • Test data fixtures
  Source: Alireza Rezvani.
• API spec writer: Share routes, code or an API description. Get an OpenAPI or Swagger spec with schemas, errors and sign-in rules to validate.
  • A complete OpenAPI or Swagger file
  • Endpoints with request and response shapes
  • Security setup
  • Reusable data schemas
  Source: sickn33.
• n8n failure handler: Share the workflow and failure cases. Add error paths, bounded retries and alert rules, then check response codes and recovery limits.
  • An error path on every step that can fail
  • A catch-all error workflow that sends an alert with the real error message
  • Retry settings for network steps, checked so nothing sends twice
  • Error replies for webhook callers, with the right status code and no private detail
  • The one setting you must switch on yourself in the n8n screen
  Source: sickn33.
• AI project context organiser: Share your project and next task. Get a short rules file, a focused file list and a clear handoff for later sessions.
  • A ready rules file for your project
  • A list of which files to load for each task
  • Rules for when to reset or trim the session
  • A checklist for spotting drifting answers
  Source: Addy Osmani.

Tasks you can use it for

• You are about to ship a new API or a change to one, and want a test plan before launch.
• A partner will call your API, and you want to know it handles bad input and failures well.
• You have a spec or Postman collection but no tests, and need a place to start.
• A bug report says "it returned 500", and you want the cases around it written down.

Limits to check before starting

• You want a real load test with traffic at scale. Use the Performance benchmark planner.
• You want a deep security test or attack simulation. Use the Penetration test planner, and only with written permission.
• You want to test a screen or a button in a web app. Use the Test Automation Engineer agent.
• You only have a public third-party API you do not control. Do not run stress or injection tests on it. Test your own code that calls it.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack from this page and add it to your AI as a skill. Or paste SKILL.md into a new chat, then paste references/source-agent.md after it.
• Paste your spec or endpoint list, the login method and one sample request and reply. Remove real keys, passwords and customer data first.
• Read the open questions. Answer them, or write down the answer your team wants, so each test has a clear expected result.
• Ask for starter code in the tool you use. Set the test address, test login and keys in settings, not in the code.
• Run the tests on a test environment you own, never on production. Paste back any failures and ask for the cause.
• Add the passing tests to your build pipeline, so they run on every change.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/testing-api-tester for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.