Selected work
API test automation suite for a fintech platform
Engagement at a glance
- API Automation
- 2024
- Fintech platform provider
What happened
Challenge
Partner-facing APIs changed frequently, and breaking changes surfaced only when integration partners reported failures — an unacceptable pattern for a financial product. There was no artifact describing what the API was supposed to do, so whether a change was breaking was a matter of opinion, usually settled after the fact. Each incident cost partner trust in a market where integration reliability is part of the product.
Approach
We built an automated API test suite covering authentication flows, schema validation, negative cases and authorisation boundaries, wired into the deployment pipeline as a release gate. Authorisation was tested horizontally — one account attempting another account’s operations — rather than only checking that a valid request succeeds. Negative and boundary cases around amounts, precision and malformed input were treated as first-class, since those are the paths that produce quietly wrong numbers rather than visible errors.
Outcome
Breaking API changes are now caught in the pipeline before release, and the contract suite doubles as living documentation of expected API behaviour. Partners find out about intentional changes from a changelog rather than from a failure, and an argument about whether a change was breaking is now settled by a test run.
Why this stack
The suite was written at the API level rather than through any interface, because the contract is what partners actually consume and the interface only exercises the subset it was built to send. Postman collections kept the tests legible to the client team, who were not test engineers and needed to be able to read and extend them. GitLab CI matched where the deployment pipeline already ran.
What we would do differently
We treated the authorisation tests as a separate later phase, which was the wrong order. Horizontal access checks — one account attempting another account’s operations — turned out to be where the findings that mattered were, and they were cheap to write once the request scaffolding existed. On a financial product we would now write those alongside the first happy-path tests rather than after them.
Stack
- TypeScript
- Postman
- GitLab CI
Contact
Something similar in flight?
Describe where it currently stands and what worries you about it. You will get a considered reply from an engineer, not an autoresponder.