QAFox · UNIVERSAL API TESTING

Before you upload your project

QAFox inspects your uploaded project or API definition, discovers APIs, creates smart test scenarios and data, executes approved API requests, validates responses and produces QA test results.

Important: uploaded application source code is inspected as evidence only. QAFox does not execute your uploaded source code.

📦 Supported uploads

✓ ZIP project archive
✓ TAR / TAR.GZ / TGZ
✓ OpenAPI / Swagger JSON
✓ OpenAPI / Swagger YAML
✓ Postman Collection

Current project upload limit: 100 MB.

🧩 Supported REST sources

✓ OpenAPI / Swagger
✓ Postman
✓ FastAPI
✓ Flask
✓ Django / DRF
✓ Express.js
✓ NestJS
✓ Spring Boot
✓ Laravel
✓ ASP.NET Core

Discovery depth can vary because frameworks and projects may define routes, validation and middleware differently.

🧪 What QAFox currently tests

✓ API endpoint and HTTP method discovery
✓ Path and query parameters
✓ Request headers and bodies
✓ Request schemas and validation constraints
✓ Positive API scenarios
✓ Negative API scenarios
✓ Required-field scenarios
✓ Boundary-value scenarios
✓ Invalid types and enum values
✓ Authentication-related scenarios
✓ Response status assertions
✓ Response schema assertions
✓ Stack-trace and secret-leak checks
✓ API duration checks
✓ Dependency-aware workflows
✓ Runtime value capture
✓ Root-cause classification
✓ HTML and JSON QA reports

🧠 Smart Test Data

QAFox does not use one fixed data set for every project. Test data is created from discovered schemas, constraints and field meaning.

✓ email → generated email
✓ UUID → generated UUID
✓ enum → documented valid value
✓ numeric fields → constraint-aware values
✓ required fields → populated
✓ nested objects and arrays

Credentials and production tokens are not invented. Authentication values must come from secure test configuration.

🔗 API workflow intelligence

QAFox can connect APIs when one API needs data returned from another.

Create Customer → Customer ID → Create Order → Order ID → Get Order

If a required dependency cannot be determined safely, QAFox should report it instead of inventing a production identifier.

🛡️ Safe execution

✓ Read-only APIs can be classified as safe
✓ State-changing APIs require approval
✓ Destructive APIs are blocked by default
✓ TLS verification remains enabled
✓ Private, loopback and unsafe targets are blocked
✓ Secrets are masked
✓ Approved execution plans are snapshotted

📊 Test results

After execution, QAFox can report information such as:

✓ APIs discovered
✓ Test scenarios generated
✓ Passed / Failed / Skipped / Error
✓ HTTP response status
✓ Execution duration
✓ Assertion results
✓ Dependency failures
✓ Root-cause information
✓ HTML report
✓ JSON report

⚠️ Important limitations

! QAFox cannot guarantee that static source inspection will discover 100% of APIs in every possible project.
! APIs created dynamically only while an application is running may not be visible from source files.
! Custom or proprietary frameworks may have limited source-code discovery.
! Route discovery can be available even when complete validation or response-schema evidence is unavailable.
! Interactive browser authentication, external identity providers and MFA may require manual configuration.
! Destructive API operations are not automatically run.
! Current security assertions are not a replacement for full penetration testing or vulnerability scanning.
! Current performance checks measure request duration; full load, stress and endurance testing belong to the future QAFox Performance Testing module.

🌐 Protocol support

✓ REST APIs — Supported
○ GraphQL — Planned
○ gRPC — Planned
○ SOAP / WSDL — Planned
○ WebSocket — Planned
○ AsyncAPI — Planned

📁 For best results

Upload the complete backend API project whenever possible.

✓ Route/controller files
✓ DTOs / request-response models
✓ Validation definitions
✓ OpenAPI / Swagger when available
✓ Postman Collection when available
! Do not upload production secrets, private keys, passwords or credential files.

🚀 What happens after upload?

1. Upload → 2. Discover APIs → 3. Configure → 4. Generate Tests → 5. Smart Data → 6. Dependencies → 7. Approve → 8. Execute → 9. QA Report

QAFox may mark inferred information as high confidence, medium confidence or review required. QAFox should show uncertainty instead of pretending an uncertain inference is definitely correct.