Module 11 · API Mocking & Contract Testing

Last updated: April 29, 2026

Why this module. APIs evolve; consumers break. Contract testing catches it before production. From a security view, contract testing also catches “we accidentally exposed an internal field” and “auth was removed from this endpoint.”

Two patterns

• Schema-first — OpenAPI spec is the contract. Validate every request/response.
• Consumer-driven (Pact) — consumers declare expectations; provider validates them.

Schema validation in production

Use the OpenAPI spec at runtime to validate every request and response. Tools: openapi-validator middleware (Express), connexion (Flask), fastapi (built in).

If response doesn’t match spec, the API has drifted — possibly leaking new fields. Alert.

Pact in 2 minutes

1. Consumer writes test: “When I call /users/1, I expect status 200 with body matching this shape.”
2. Test generates a “pact” file documenting expectation.
3. Provider runs pact verification against its own implementation.
4. Provider can’t merge if any consumer’s pact fails.

Security wins from contract testing

• “Authorization header was removed” caught by consumer pact.
• “Response started returning email field accidentally” caught by schema mismatch.
• “Endpoint added without spec update” — flagged as missing pact.

Defender’s checklist

• OpenAPI spec for every API; in source control.
• Schema validation middleware in production.
• Pact (or similar) for consumer-driven contracts where multiple services depend.
• CI fails if spec drifts from implementation.