MatrixIntermediate4-6 min reference
API Negative Testing Matrix
Positive tests prove the API works; negative tests prove it fails safely. This is a matrix of the inputs worth firing at any endpoint, the response you'd expect, and the assertion. Use it as a checklist seed — link to the full API testing checklist and input-validation guide below for depth.
The matrix
| Category | Input | Expected | Assert |
|---|---|---|---|
| Auth | No / invalid token | 401 | Not 200 with empty data |
| Auth | Valid token, wrong scope/owner | 403 | Can't reach another user's data |
| Required field | Omit a required field | 400 / 422 | Error names the field |
| Type | String where number expected | 400 | Not a 500 |
| Enum | Value outside the allowed set | 400 | Rejected, not coerced |
| Boundary | min−1, max+1, empty, very long | 400 | Limits enforced both ends |
| Format | Bad email / date / UUID | 400 | Format validated |
| Payload | Empty body, malformed JSON | 400 | Not a 500 stack trace |
| Size | Oversized payload / array | 413 / 400 | Limit enforced |
| Method | Wrong verb (PUT on read-only) | 405 | Allow header present |
| Content-Type | Missing / wrong | 415 | Not silently accepted |
| Rate | Rapid repeat calls | 429 | Retry-After present |
| Not found | Nonexistent id | 404 | Not 200 with null |
| Injection | SQL/script in a field | 400 + safe handling | No execution, no leak |
Golden rules
- A bad request must never return
500— that's the server crashing, not validating. - Error responses should be safe: no stack traces, SQL, or internal paths.
- The status code must match the failure class (
400vs401vs403vs404).
Common mistakes
- Only testing valid input — most security and stability bugs live on the negative paths.
- Accepting
200with an empty/nullbody where404/400is correct. - Letting validation errors surface as
500s. - Skipping boundary values (off-by-one at min/max is the classic miss).
Injection and auth-bypass attacks belong in authorized security testing — this sheet covers the safe input-validation cases QA owns.
// Related resources