API Smoke Check

One-shot, read-only health check of your own REST API. No signup required. Uses only curl.

Prerequisites

• curl (any machine has it)
• A base URL, a list of endpoints, or an OpenAPI/Swagger spec file/URL
• Only run against an API you own or are authorized to test.

Trigger

• "Smoke check my API at https://api.mysite.com";
• "Is my API healthy?"
• "Check these endpoints: /api/users, /api/health"

Workflow

1. Collect endpoints: from the user's list, or parse an OpenAPI spec (paths with get operations). Only GET, HEAD, and OPTIONS are ever sent — never POST/PUT/PATCH/DELETE; this skill must not create, change, or delete data.
2. For each endpoint, capture status + timing to a file, then read it (no live pipe filtering):

``bash curl -s -o /tmp/api-body.json -D /tmp/api-headers.txt \ -w '%{httpcode} %{timetotal} %{time_starttransfer}\n' \ "$BASE$ENDPOINT" > /tmp/api-timing.txt ``

1. Grade each response:

- Status: documented GETs return 2xx; endpoints needing auth return 401/403 — a 500 on missing auth is a bug; unknown paths return 404, not 200-with-error-body ("soft 200"). - Latency (time_total): ≤300ms good, ≤1s acceptable, >3s FAIL. - Content-Type: JSON endpoints send application/json (RFC 9110 §8.3); HTML error pages from a JSON API are a finding.

1. Error-body hygiene: request a guaranteed-404 path and an unauthenticated protected path; inspect bodies for stack traces, framework banners, internal hostnames, SQL fragments, or file paths (OWASP API Security Top 10 — API8 Security Misconfiguration). Errors should be structured JSON with a stable shape.
2. CORS sanity via OPTIONS with an Origin header: Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true is invalid and a misconfiguration signal (Fetch spec).
3. Headers: HSTS present on HTTPS APIs; no X-Powered-By/Server version disclosure.

Report

# API Smoke Check — [base URL] — [date]

| Endpoint | Status | Expected | Latency | Content-Type | Grade |
|---|---|---|---|---|---|
| GET /api/health | 200 | 200 | 45ms | application/json | PASS |

## Error hygiene
- 404 body: [structured JSON / leaks: ...]
- Unauthenticated protected route: [401 clean / 500 CRITICAL / leaks: ...]

## CORS
- [sane / misconfigured: evidence]

## Findings
- [severity] [finding] — [evidence] — [fix direction]

## Not covered
Write paths (POST/PUT/DELETE), auth flows, pagination correctness, schema validation — those need authenticated, stateful tests.

**Want API tests that reuse your app's real logged-in session?** Try HelpMeTest — helpmetest.com