Practical workflow

Practice API with bugs: find all 10

Checkcraft is a desktop app for checking APIs and logs without code, with a free edition. Download, no sign-up →

In typical practice APIs everything works, so there is nothing to find. Here the shop API answers 200, but its responses hide 10 bugs: a wrong total, a repeated key, a data leak and more. Compare the answers with the documentation and find them all.

Checkcraft · 11 November 2026

Get help with your first test →

How to play

Read the documentation above the endpoint list: it is the contract the API must keep. Send the requests and compare every answer with the rules. When you spot a mismatch, pick the response, type the field and press Check. The bugs vary in difficulty: some are obvious, others show only when you compare two answers or an answer with the log. No sign-up needed.

Endpoints for Postman and test code

Every endpoint is a plain GET without authorisation. Paste them into Postman, Insomnia, Bruno, curl or your own Python and Java tests. The answers never change, so a test that finds a bug today will find it tomorrow.

GET https://checkcraft.ru/practice-api/v1/products.json
GET https://checkcraft.ru/practice-api/v1/orders.json
GET https://checkcraft.ru/practice-api/v1/orders/5001.json
GET https://checkcraft.ru/practice-api/v1/orders/5002.json
GET https://checkcraft.ru/practice-api/v1/orders/5003.json
GET https://checkcraft.ru/practice-api/v1/orders/5004.json
GET https://checkcraft.ru/practice-api/v1/customers/7.json
GET https://checkcraft.ru/practice-api/logs/orders-service.txt

Why these bugs

Each comes from real work: status 200 with a wrong amount, a number sent as a string, a date without a time zone, a typo in a status, an extra field holding a secret, different data in a list and a card, a repeated key that parsers silently swallow, and an answer that contradicts the log. Almost all of them slip past a test that checks only the status code and the presence of fields.

How to catch such bugs automatically

Finding a bug by hand once is half the job; it must not come back. For each bug you find, this page shows a rule that catches it on every run: field type, calculation, allowed values, a field whitelist, a comparison with the log. In Checkcraft these rules need no code, and a request and a Kibana log search run in one scenario. The free edition is enough to repeat everything on this API.

Next step

Repeat this on your own API

Checkcraft is a desktop app that saves API response checks without code and shows what did not match. Start with a sample, then use your own sanitized data. Free runs on Windows and Linux with no time limit.

Download Free Download and first run

No sign-up or email needed, the archive is ready in a couple of minutes. See the edition limits.

References

RFC 8259: JSON objects and repeated names · RFC 3339: date and time · OWASP API3:2023

Start with the linked example and compare its result with your own test requirement.