OpenAPI/Swagger specs, GraphQL SDL, JSON Schema, paginated and problem+json error payloads, and webhook samples — for testing API clients, mock servers, contract tests, and schema validators.
A small but complete OpenAPI 3.1 description (two paths, three schemas) in JSON — for testing API tooling, mock servers, client codegen, and docs generators.
The same OpenAPI 3.1 description in YAML — the format most API definitions ship in. Paired with the JSON twin for testing YAML↔JSON conversion and spec parsers.
A GraphQL Schema Definition Language (SDL) file with queries, a mutation, object/input types, and an enum — for testing GraphQL schema parsers, linters, and code generators.
A proto3 Protocol Buffers schema with messages, an enum, and a repeated field — for testing protobuf compilers (protoc), codegen, and schema tooling.
Page 1 of a paginated JSON API response (users), with page metadata and a `hasMore` flag. Paired with page 2 for testing pagination and infinite-scroll logic.
Page 2 (the final page) of a paginated JSON API response. Paired with page 1 for testing pagination, `hasMore` handling, and list merging.
A 404 error body in RFC 9457 (problem+json) form, with type, title, status, detail, and instance — for testing structured error handling and problem-detail parsers.
A 422 validation-error response with a machine-readable list of field errors — for testing form-validation surfacing and error mapping.
A valid OpenAPI 3.1 pet-store SAMPLE spec in JSON — list/create pets with paginated responses for schema-validator and codegen tests.
YAML twin of the valid pet-store OpenAPI spec — for testing YAML spec parsers and JSON↔YAML conversion.
Sample POST /pets request body matching the pet-store OpenAPI spec.
Sample paginated pet list response for mock-server and contract tests.
Sample 404 problem response for OpenAPI error-handling tests.
Minimal OpenAPI 3.1 document with a webhooks section — for testing webhook-aware spec parsers.
Cursor-paginated SAMPLE API response page 1 with nextCursor metadata.
Cursor-paginated SAMPLE API response page 2 with nextCursor metadata.
Offset/limit paginated SAMPLE response page 1 for list-merge tests.
Offset/limit paginated SAMPLE response page 2 for list-merge tests.
Sample GraphQL query response with nested user and orders — for GraphQL client tests.
Sample GraphQL mutation success payload for testing mutation handlers.
GraphQL error response with message and location — negative case for GraphQL clients.
SAMPLE stripe payment webhook JSON body for signature-verification and parser tests.
SAMPLE github push webhook JSON body for signature-verification and parser tests.
SAMPLE slack message webhook JSON body for signature-verification and parser tests.
GraphQL subscription event payload for realtime client tests.
Rate-limit header values captured as JSON for middleware testing.
Documented HMAC webhook signature SAMPLE — no real secret, for verifier unit tests.
Batch API response mixing success and failure per sub-request.
Partial GraphQL introspection result for schema-stitching tests.
Callback payload matching the Wave F webhook OpenAPI SAMPLE.
RFC 5988 Link header pagination metadata as JSON for HTTP client tests.
Nested pagination object for comments under a post — tests deeply nested page tokens.
Empty paginated response — edge case for UI empty states and merge logic.
Paginated response where total count disagrees with items length — tests inconsistency detection.
Fictional insurance eligibility check response for prior-auth workflow tests.
Stripe-style payment intent SAMPLE JSON for checkout integration tests.
End-of-month account balance snapshot for open-banking API mock tests.
The baseline member of a JSON Schema 2020-12 customer contract. Reference contract: id and name are required strings.
The compatible member of a JSON Schema 2020-12 customer contract. Backward compatible: existing instances remain valid because email is optional.
The breaking member of a JSON Schema 2020-12 customer contract. Breaking relative to baseline: id changes from string to integer and tenantId becomes required.
The baseline member of a complete OpenAPI 3.1 ticket endpoint contract. Reference API: string ticket IDs and required id/summary response properties.
The compatible member of a complete OpenAPI 3.1 ticket endpoint contract. Backward compatible: an optional priority response property is added and existing operations stay unchanged.
The breaking member of a complete OpenAPI 3.1 ticket endpoint contract. Breaking relative to baseline: ticket id becomes integer and status becomes a required response property.
The baseline proto3 Customer message for field-number and wire-compatibility testing. Reference wire contract: field 1 is string id and field 2 is string name.
The compatible proto3 Customer message for field-number and wire-compatibility testing. Backward compatible: existing field numbers/types are retained and optional email uses new field number 3.
The breaking proto3 Customer message for field-number and wire-compatibility testing. Breaking relative to baseline: field number 2 is reused with a different name and wire type.
The baseline Avro record schema for reader/writer compatibility tests. Reference writer schema: id and name are strings.
The compatible Avro record schema for reader/writer compatibility tests. Backward compatible for old records: nullable email is added with a null default.
The breaking Avro record schema for reader/writer compatibility tests. Breaking relative to baseline: id changes to long and tenantId has no default.
SAMPLE OpenID Connect discovery document for OIDC client and metadata parsers.
SAMPLE OAuth 2.0 token endpoint JSON with access, refresh, and id_token fields.
SAMPLE OAuth error JSON for token-endpoint failure handling.
SAMPLE RFC 7662-style token introspection response for auth middleware tests.
SAMPLE CORS response header block as plain text for header parsers and policy tests.
SAMPLE CSP header line for CSP parsers and security-header scanners.
SAMPLE Strict-Transport-Security header for TLS policy scanners.
SAMPLE Permissions-Policy / Referrer-Policy / XCTO / XFO header pack.
Intentionally misconfigured CORS SAMPLE (* + credentials) for policy linters.
SAMPLE X-XSS-Protection: 0 header for legacy header scanners.
SAMPLE OAuth device-authorization response for device-flow client tests.
The DER OCSPRequest a client sends when checking the reference leaf, with the SHA-1 CertID that RFC 6960 mandates and no nonce extension. POST it at a stub responder to exercise request parsing without a live CA.
A successful OCSP response asserting status good for the reference leaf, signed directly by the SAMPLE issuing CA. Pair it with the request beside it to stub a responder end to end.
One payload carrying two independent signatures — RS256 and EdDSA — in the General JSON serialization that the compact form cannot express. Multi-signature handling is the part of RFC 7515 most libraries never implemented.
The single-signature flattened JSON form of the exact same RS256 token shipped in compact serialization. Both encodings must verify to the identical payload, which is the round-trip this pair is for.
A five-request page load — document, stylesheet, script, image and favicon — across two fictional hosts, with full per-phase timings and an onLoad page timing. Every entry's time equals the sum of its non-negative timing phases, so a waterfall renderer can be checked arithmetically rather than by eye.
A four-call REST session against a fictional API host, with JSON request bodies in postData, an Authorization header carrying an obvious SAMPLE placeholder token, and a 204 response that has no body at all. The right shape for testing a HAR-to-mock-server or HAR-to-code converter.
An http URL that redirects to https and then to a query-carrying cart page, with redirectURL populated on both hops. Tools that count entries as page views report three here when the user saw one page.
Five failing requests covering authentication, authorisation, a missing resource, rate limiting with a Retry-After header, and a server error that returns HTML instead of the JSON the client asked for. The last one is the case that breaks clients which parse by status code rather than by content type.
A full session-cookie lifecycle: set at login, echoed on the next request, then expired at logout with Max-Age=0. Both the header and the parsed cookies array are present, and every value — including the form password field — is an obvious SAMPLE placeholder rather than a credential.
Four API calls in which the wait phase — time to first byte — accounts for almost all of the elapsed time, the signature of a server-bound rather than network-bound page. Use it to check that a performance report attributes the cost to the server instead of blaming connection setup.
One form submission whose postData carries both the parsed params array and the raw urlencoded text — and the two must agree. The notes field contains a comma and an ampersand, so a decoder that splits before unescaping produces seven fields instead of five.
A two-part multipart/form-data upload: a text file part with a fileName and a plain field part. The body uses CRLF between MIME parts because RFC 7578 requires it, even though the surrounding HAR document is LF-terminated — a distinction that matters when a replay tool rewrites the body.
A PNG response whose body is carried as base64 with content.encoding set accordingly. content.size is the DECODED byte count, not the length of the base64 string, which is the field readers most often get wrong when computing transfer weight.
A gzip-compressed JSON response where content.size is the uncompressed length, bodySize is the bytes on the wire, and content.compression is the saving between them. It also carries the non-standard _transferSize field browsers add, which readers must tolerate rather than reject.
Two navigations in one capture, with entries bound to their page through pageref. The second page's onLoad is -1, the HAR convention for a timing that never happened, which naive code averages in as zero and reports as an impossibly fast load.
A conditional request answered 304 with full beforeRequest and afterRequest cache state, next to a first-time fetch whose beforeRequest is null. The null is the documented way to say "not in the cache", and readers that treat it as a missing object rather than an explicit absence lose the distinction.
An HTTP/2 entry with lowercase pseudo-headers, an httpVersion of "h2" rather than "HTTP/2.0", an ssl phase inside connect, and three underscore-prefixed custom fields. Version strings are not standardised across writers, so anything matching on "HTTP/1.1" misses this entry entirely.
One request whose query string encodes a space as %20 in one parameter and as + in another, includes a parameter with an empty value, and carries an Accept-Language header with quality values. The parsed queryString array is the answer key for whatever a URL parser produces from the raw URL.
An instant-query response: five up series at a single evaluation timestamp, one of them zero, plus a warnings array that clients routinely ignore. A successful response can carry warnings, and dropping them hides truncated results.
The error envelope a Prometheus API returns for a malformed PromQL query — status, errorType, a message with a line and column position, and an empty but present data object. Clients that only check for a data key render this as a successful empty result.
The JSON body Alertmanager POSTs to a webhook when an alert fires, including the detail that catches everyone: endsAt is Go's zero time rather than null or absent, so a receiver that parses it as a real timestamp records an alert that ended in the year 1.
The resolved notification for the same alert half an hour later, carrying an identical fingerprint and group key with endsAt now populated. Paired with the firing payload so incident-tracking code can be tested for correctly closing the incident it opened.
One notification carrying twelve grouped alerts with truncatedAlerts set to 8, meaning twenty were firing. Receivers that count the alerts array report a smaller incident than actually exists — the field is there precisely so that does not have to happen.
A CycloneDX SBOM that declares external services and composition completeness alongside components — the sections tools most often skip. Both services are fictional endpoints on the .example domain. Every package, version, hash and licence is fictional — the tree describes nothing real.
The shape a hosted dependency-alert API returns: alerts with lifecycle state, a nested advisory, a patched-version pointer and an explicitly null dismissed_reason on the alerts that were not dismissed. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
We use Google Analytics and show ads via Adsterra. Non-essential cookies and ad scripts run only after you allow the matching categories. See our cookie policy.
