Testing & QA
Target: Claude 3.7, Cursor, Windsurf, ChatGPT

API Endpoint Fuzzing & Boundary Value Test Matrix

Generate adversarial fuzzing test cases, SQL injection payloads, and schema violation matrices for REST endpoints.

SecurityTestingFuzzingRESTQA

Interactive Prompt Playground

Customize Template Fields
Live replacement
{{ENDPOINT_SPEC}}
{{AUTH_ROLES}}
Rendered Prompt (Ready to paste)1380 characters
You are a Principal Security QA Engineer and Fuzzing Specialist.

Generate an adversarial test matrix and automated fuzzing suite for this API endpoint:

API Endpoint Schema & Contract:
```json
POST /api/v1/workspaces/{workspaceId}/invite
Headers: Authorization: Bearer <token>
Body:
{
  "email": "string (valid email)",
  "role": "enum: ['MEMBER', 'ADMIN', 'VIEWER']",
  "expiresInDays": "integer (1 to 30)"
}
```

Expected Authentication / Roles: Requires authenticated user with ADMIN role in workspace

Produce an exhaustive test matrix spanning:
1. **Type & Payload Fuzzing**:
   - Array overflows (10,000 elements), huge strings (10MB strings), deeply nested JSON objects (100 levels).
   - Type coercion attacks (passing numbers where booleans are expected, arrays where strings are expected).
2. **Adversarial & Injection Payloads**:
   - SQL Injection strings (`' OR 1=1 --`, `admin' --`).
   - XSS vectors (`<script>alert(1)</script>`, `javascript:void(0)`).
   - Path traversal (`../../etc/passwd`) in string parameters.
3. **Boundary Value Analysis**:
   - UTF-8 multibyte characters, emoji strings, right-to-left override characters, null byte (`\0`).
4. **Test Table Matrix & Automated Test Code**:
   - Output a clear Markdown Test Matrix (Case ID, Payload, Expected HTTP Status, Expected Error Code).
   - Provide automated test code implementing the fuzzing runs.

How to Use This Prompt

  1. Paste your endpoint specification and accepted field types.
  2. Receive a structured adversarial test matrix with ready-to-run automated test scripts.

Engineering Tips & Best Practices

  • Ensure all 400 Bad Request responses return structured validation error paths so client forms can highlight fields.

What This Prompt Inspects

Key failure modes, design principles, and quality standards evaluated during execution.

Payload Explosion

Verifies max request body size limits prevent server memory exhaustion.

Injection Resistance

Validates input sanitizers reject raw SQL/HTML tokens.

HTTP Status Contract

Ensures bad payloads consistently return 400 or 422 rather than 500.

SprintKit Workflow Integrations

Complementary interactive tools and workflows across SprintKit to accelerate your engineering process.

Related Prompts

Explore related developer prompts in this workflow domain.

All Prompts

Security Vulnerability & OWASP Code Audit

Audit backend and frontend code for OWASP Top 10 vulnerabilities, authentication bypasses, IDOR, and injection flaws.

SecurityOWASPAuthBackend+1
3 variablesCustomize prompt

RESTful API Design & Backward Compatibility Review

Design or review RESTful API contracts for idempotency, pagination, error models, and non-breaking versioning.

APIRESTOpenAPIArchitecture+1
3 variablesCustomize prompt

Unit Test Suite Generator with Edge Cases

Generate comprehensive, mutation-tested unit tests with AAA pattern, boundary cases, and proper mock boundaries.

TestingJUnitVitestPytest+2
3 variablesCustomize prompt