Test your API from a spec you already have
Point Stakari at a Postman collection or an OpenAPI document. It confirms the endpoints with you, then tests them.
What it tests
- Accepts a Postman collection (v2.1), an OpenAPI 3.x document, or a URL.
- Probes only standard documentation paths. It never guesses or brute-forces endpoints.
- Shows the parsed endpoints, auth and variables for you to confirm before any request is sent.
- Tests baseline, contract, negative and boundary, authentication, idempotency, concurrency and business-flow chains.
- Evaluates your invariants by calling confirmed read endpoints after a scenario.
- Runs asynchronously, rate-limits its own traffic, and honors environment policy on every request.
How a run goes
- Step 1
Import the spec
Upload a Postman collection or OpenAPI document, or give a URL to a standard docs path.
- Step 2
Confirm endpoints
Check the parsed endpoints and auth before anything runs.
- Step 3
Get curl reproductions
Every finding comes with a curl command you can run yourself.
Coming soon
- Run Postman pre-request and test scripts through a compatible runner.
- Accept recorded traffic (HAR) as an input.
- Mass assignment checks for fields the caller should not control.
Explore the other modules
- Web app testingDrive your app in a real browser, one isolated session per role.
- Multi-role & multi-tenantCheck the access matrix and try to cross between tenants.
- Workflow testingChain UI, API and state checks, then check everything agrees.
- AI agent testingMulti-turn attacks with canary and state oracles.