Skip to content
h2check
ChecksToolsChecklists
Checks

API checks

29 procedures covering CORS, rate limits, JSON Schema validation, JWT, idempotency. Out of scope here: API design, contract testing frameworks.

Request Behaviour

  • How to check API endpoint5 min
  • How to check API response time5 min
  • How to check API versioning8 min
  • How to check HTTP status code3 min
  • How to test API concurrency10 min
  • How to test API error responses8 min
  • How to test API idempotency12 min
  • How to test API pagination9 min
  • How to test API timeout handling6 min
  • How to test API with curl6 min
  • How to test API with invalid input10 min
  • How to test webhook delivery8 min
  • How to validate cron expression4 min

Tokens and Auth

  • How to check JWT algorithm6 min
  • How to check JWT expiration4 min
  • How to decode JWT3 min
  • How to test API authentication8 min
  • How to verify JWT signature6 min

JSON and Schema

  • How to check content-type of API response3 min
  • How to check if API returns valid JSON5 min
  • How to validate JSON against schema6 min
  • How to validate OpenAPI spec6 min

CORS

  • How to check CORS configuration6 min
  • How to test CORS with curl4 min
  • How to test preflight request5 min

Rate Limits

  • How to check rate limit headers3 min
  • How to test API rate limiting6 min
  • How to test retry-after header5 min

Security Headers

  • How to check HTTP response headers with curl4 min

Checklists

  • API security review12 checks
  • API testing checklist16 checks

Questions people ask about this area

  • how to check which origins an api allows
  • how does pagination work in api

h2check.org is published by Maks Verny. Every procedure lists the date its commands were last run.

Checks · Tools · Checklists

Methodology · About · Contact

Checker inputs and results are not stored. What that means in practice is on the methodology page.