# API Testing Checklist

- [ ] Contract, method, URL and headers
- [ ] Expected status and body
- [ ] Required fields, types, nulls and boundaries
- [ ] Missing, invalid and expired authentication
- [ ] Authorization by role and ownership
- [ ] Missing resource and malformed identifier
- [ ] Duplicates, idempotency and concurrency
- [ ] Pagination, filtering and sorting
- [ ] Timing, limits and failure behavior
- [ ] Logs and responses without secrets