HTTPie API Tester

Use this skill to automatically discover all API endpoints in a project and test them with HTTPie.

Overview

HTTPie (http) is a modern, human-friendly CLI HTTP client. It produces colorized, formatted output and has terse syntax for common patterns.

Install if missing:

pip install httpie --break-system-packages

Step 1: Discover Endpoints

Scan the project to find all defined API routes. Use multiple strategies in parallel:

Framework Detection & Route Discovery

# Detect framework
find . -name "package.json" -o -name "requirements.txt" -o -name "Gemfile" \
       -o -name "go.mod" -o -name "Cargo.toml" | head -5

Then use the appropriate strategy from references/discovery.md for the detected framework.

Quick universal scan (works across frameworks):

# Find route definitions by common patterns
grep -rn --include="*.js" --include="*.ts" --include="*.py" --include="*.rb" \
     --include="*.go" --include="*.java" --include="*.rs" \
     -E "(GET|POST|PUT|PATCH|DELETE|app\.(get|post|put|patch|delete)|router\.(get|post|put|patch|delete)|@(Get|Post|Put|Patch|Delete|RequestMapping))" \
     . --exclude-dir={node_modules,.git,dist,build,vendor} 2>/dev/null | head -60

Also check for OpenAPI/Swagger specs:

find . -name "openapi.yml" -o -name "openapi.yaml" -o -name "swagger.json" \
       -o -name "swagger.yaml" -o -name "api.yml" 2>/dev/null | head -5

Read references/discovery.md for framework-specific patterns (Express, FastAPI, Django, Rails, Go, etc.)

Step 2: Determine Base URL

Ask the user or infer from config files:

# Common config file locations
cat .env 2>/dev/null || cat .env.local 2>/dev/null || cat config/application.rb 2>/dev/null
grep -r "PORT\|HOST\|BASE_URL\|SERVER_URL" .env* config* *.config.* 2>/dev/null | head -10

HTTPie localhost shorthand:

• :3000 → http://localhost:3000
• :/api/users → http://localhost/api/users

Default assumption: http://localhost:8000 (adjust per project).

Step 3: Build & Run HTTPie Commands

HTTPie Syntax Reference

# Basic methods
http GET :8000/api/users
http POST :8000/api/users name="Alice" email="[email protected]"
http PUT :8000/api/users/1 name="Alice Updated"
http PATCH :8000/api/users/1 active:=false
http DELETE :8000/api/users/1

# Headers
http GET :8000/api/protected Authorization:"Bearer <token>"

# Query params
http GET :8000/api/search q==hello page==1

# JSON body (explicit)
http --json POST :8000/api/data key=value count:=42 tags:='["a","b"]'

# Form data
http --form POST :8000/upload file@/path/to/file.txt

# Auth shortcuts
http -a username:password GET :8000/api/secure        # Basic auth
http --bearer TOKEN GET :8000/api/secure              # Bearer token

# Useful flags
http --check-status ...    # Exit non-zero on 4xx/5xx
http --timeout=5 ...       # Set timeout in seconds
http --verify=no ...       # Skip SSL verification (dev only)
http --follow ...          # Follow redirects
http --print=HhBb ...      # H=request headers, h=response headers, B=request body, b=response body

# Quiet / script-friendly
http --ignore-stdin --check-status GET :8000/health

Testing Patterns

Health check first:

http --ignore-stdin GET :8000/health || http --ignore-stdin GET :8000/

Test with output saved:

http GET :8000/api/users > /tmp/users_response.json

Test all endpoints in sequence, report pass/fail:

# Use --check-status to catch errors; capture exit codes
http --check-status --ignore-stdin GET :8000/api/users && echo "✅ GET /api/users" || echo "❌ GET /api/users"

Step 4: Run the Test Suite Script

Use scripts/run_tests.sh as a template — generate a customized version for the project.

See references/test_script_template.sh for the full template with:

• Color-coded pass/fail output
• Response time tracking
• Summary report at the end
• Auth token support

Step 5: Report Results

Present results in a clear table:

Note any:

• Unexpected status codes
• Slow responses (>500ms)
• Auth-required endpoints that need tokens
• Endpoints that need request body examples

Tips & Edge Cases

• Server not running: Remind user to start their dev server first
• Auth endpoints: Ask for a token or credentials; test /login or /auth first and extract the token
• Dynamic IDs: Use a real ID from a prior GET response or ask the user
• CORS/SSL issues in dev: Use --verify=no for self-signed certs
• Streaming responses: Use http --stream GET :8000/events
• File uploads: Use http --multipart POST :8000/upload file@./test.png