DummyJSON API Regression Suite

Working API QA automation suite for the public DummyJSON contract, focused on authentication, cart flows, negative authorization scenarios, reusable pytest fixtures, and repeatable CI execution.

Coverage	Test design	Stack
Authentication and cart CRUD, including negative authorization and missing-resource scenarios	Reusable fixtures, independent checks, HTTP/status validation and response-contract assertions	Python 3.12 · pytest · requests · GitHub Actions

Coverage

• Authentication: successful/failed login, authenticated profile retrieval, unauthorized access.
• Carts: read, create, update and delete flows.
• Negative paths: invalid credentials, missing authorization and nonexistent resources.
• Contract behavior: assertions follow the actual upstream response schema instead of assuming conventional status codes or field names.

Quick start

python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
pytest -v

Project structure

DummyJSON_Test/
├── tests/
│   ├── test_auth.py      # authentication and authorization checks
│   └── test_carts.py     # cart API checks
├── conftest.py           # reusable pytest fixtures
├── integration-fixture/  # integration support data
├── docs/                 # maintenance notes
├── requirements.txt
└── README.md

API behavior captured by the suite

The automated checks intentionally reflect observed upstream behavior:

• login returns accessToken rather than a generic token field;
• invalid passwords currently return 400 Bad Request;
• cart deletion is represented by isDeleted: true instead of physical removal;
• cart updates require the API's merge semantics.

These details are treated as external contract behavior. If upstream behavior changes, the live API contract is verified before expected results are updated.

Engineering notes

• credentials and generated local artifacts are excluded from Git;
• shared setup is isolated in pytest fixtures;
• CI executes the suite on repository changes;
• dependency security is checked with a scheduled and change-triggered audit;
• tests are kept independent where the API allows it;
• negative checks validate both authorization behavior and missing-resource handling.

Maintenance

Pre-merge and upstream-contract checks are documented in docs/maintenance.md.

---

Related work

• Auto-Pricing Bot — production marketplace automation with Telegram control, seller APIs, Docker and safety guards.
• Commercial AI SaaS QA — sanitized commercial QA case with 150+ checks and selected defects.
• GitHub profile — selected QA and Python engineering work.