Skip to content
Book a call
Fintech · EU

3,000+ API combinations covered on every merge

Combinatorial, contract, security and load testing of a fintech API, running in CI on every merge.

3,000+ parameter combinations covered
  • 3,000+ parameter combinations covered
  • 140+ bugs reported, 19 critical
  • 12 min API regression on every merge
  • PlatformsAPI
  • Engagement5 months · 2 QA engineers
Challenge

An API with many parameters, currencies and limits was covered only on the main happy paths. Rare combinations failed in production, and each fix risked breaking another case.

What we did

We built pairwise test sets for parameters, currencies and limits, and added contract checks against the OpenAPI spec. We ran OWASP API Top 10 security checks and load tests, then put the whole suite into CI.

Result

Coverage grew by 3,000+ parameter combinations. Rare combinations are now checked on every merge instead of being discovered in production.

Before and after
Before Test SquadAfter
Coverage Main happy paths 3,000+ parameter combinations
Rare cases Fail in production Checked on every merge
Documentation Drifted from real behavior Verified against the OpenAPI spec
Regression Manual, before releases 12 minutes in CI
Timeline
  1. Weeks 1–2

    API analysis, combinatorial model

  2. Weeks 3–10

    Test sets, contract checks, first CI runs

  3. Weeks 11–16

    Security and load testing

  4. Weeks 17–20

    Reporting, handover, documentation fixes

Tools

  • Postman
  • Newman
  • k6
  • GitHub Actions
  • Swagger
  • OWASP ZAP
  • Datadog
  • Rollbar
  • Grafana
  • Prometheus

Testing types

APIcombinatorial (pairwise)contract (OpenAPI)negative and boundarysecurity (OWASP API Top 10)load testingregressiontest automation

Related cases

Want results like these?

Book a short call about your product. We can start with a free QA audit or a trial.

Book a call →