Configuration

Fuzzing

Generate fuzzed Postman requests from OpenAPI constraints to trigger and contract-test your API's validation and error responses.

Fuzzing in Portman generates extra requests with invalid input derived from your OpenAPI constraints: missing required fields, numbers outside minimum and maximum, and strings outside minLength and maxLength. Each fuzzed request expects a validation or error response, which you can check with contract tests. Fuzzing is configured inside a variation.

Example

json

{  "version": 1.0,  "tests": {    "variationTests": [      {        "openApiOperation": "*::/crm/*",        "openApiResponse": "422",        "variations": [          {            "name": "Unprocessable",            "fuzzing": [              {                "requestBody": [                  {                    "requiredFields": {                      "enabled": true                    },                    "minimumNumberFields": {                      "enabled": true                    },                    "maximumNumberFields": {                      "enabled": true                    },                    "minLengthFields": {                      "enabled": true                    },                    "maxLengthFields": {                      "enabled": true                    }                  }                ],                "requestQueryParams": [                  {                    "requiredFields": {                      "enabled": true                    }                  }                ]              }            ],            "tests": {              "contractTests": [                {                  "statusCode": {                    "enabled": true                  },                  "contentType": {                    "enabled": true                  },                  "jsonBody": {                    "enabled": true                  },                  "schemaValidation": {                    "enabled": true                  }                }              ]            }          }        ]      }    ]  }}

This creates fuzzed requests for every CRM operation and checks each response against the 422 response defined in the spec. The fuzzed requests are placed in the "Variation testing" folder, separate from the normal requests.

Fuzzing targets

Target	Description
`requestBody`	Fuzz the request body. Only for request bodies of media type `application/json`.
`requestQueryParams`	Fuzz the query parameters.
`requestHeaders`	Fuzz the request headers.

Fuzzing options

Each target accepts the same options, each enabled with { "enabled": true }:

Option	Description
`requiredFields`	Removes the properties marked as required in OpenAPI.
`minimumNumberFields`	Sets numeric fields to a value lower than their `minimum`.
`maximumNumberFields`	Sets numeric fields to a value higher than their `maximum`.
`minLengthFields`	Sets values shorter than their `minLength`.
`maxLengthFields`	Sets values longer than their `maxLength`.

Portman generates a separate request for every fuzzable property it finds, so a spec with many constraints produces many requests.

Notes

Postman dynamic variables are rendered before being fuzzed.
Regular Postman variables are skipped from fuzzing.
Fuzzed variations accept the same tests, overwrites and assignVariables as other variations.

Source: Portman README

Overwrites

Pre-request scripts