An API testing checklist for SaaS teams

• Valid credentials return a token with the expected lifetime
• Invalid, expired and wrongly signed tokens are rejected with 401
• Requests without a token are rejected
• Scopes in the token are enforced (403 when missing)
• HTTP is redirected or refused; only HTTPS is served

• A user of tenant A cannot read, change or delete tenant B's objects, on every endpoint with an ID
• The same holds for derived endpoints: PDFs, exports, attachments, 'send' actions
• Roles: each role can do exactly what its description says, no more
• Filters, search and pagination never return another tenant's data

• Required fields missing → 400 with a clear message
• Wrong types, formats and enum values → 400, never silently ignored
• Boundary values: zero, negative, very large, too many items
• Unknown fields are rejected or ignored consistently
• Dangerous input (HTML, formulas, very long strings) is stored and returned safely

• Every successful response matches the OpenAPI schema: required fields, types, enums
• Documented error responses match reality
• Documented limits (page size, rate limits) match what the API enforces
• Deprecated endpoints still behave as documented until removal

• Page size and cursor work; the last page has no next cursor
• No duplicates or gaps when paging through all results
• Totals match the number of items you can actually page through
• Every listed item can be retrieved by its ID

• Calculations (totals, taxes, rounding) are correct for typical and edge cases
• State changes follow the business rules (e.g. a cancelled invoice cannot be sent)
• Idempotency keys or duplicate protection on create and payment operations
• Webhooks are signed, retried with back-off and logged

• Response times measured on every run (median and p95) and compared to a budget
• Rate limiting returns 429 with Retry-After
• Errors under load are 503 with Retry-After, not 500 with a stack trace

Keep the suite in the same repository as the API, run it on every deploy to staging, and fail the pipeline on new failures. Use read-only checks and a dry-run mode or dedicated test tenants for writes, so the suite can also run safely against a shared environment.