Idempotency Harness Checker

Idempotency Harness Checker turns an OpenAPI specification or a simple endpoint list into tests for retry behavior. It is aimed at the kind of API bug that can create a second charge, refund, order, or record when a client repeats a request after a timeout or server error. The tool reads the operations, identifies writes that may have a real-world effect, and checks whether the documented contract explains how an idempotency key works. It then generates a runnable suite that exercises the risky paths. The entire reading and generation process runs in the browser, without an account and without uploading the specification to the service.

Input can be OpenAPI 3 JSON or YAML. Teams without a checked-in specification can instead paste one endpoint per line and describe the idempotency key, though the generated bodies are necessarily generic when there is no schema. The checker resolves local references and merges parameters declared at path and operation level. It classifies writes by effect, separating money-moving operations such as charges and payouts from record operations such as orders, customers, and webhooks. Reads are skipped with a reason. DELETE operations are also skipped because repeated deletion does not create another record under normal HTTP semantics.

For each relevant operation, the checker looks for three parts of a complete replay contract. The key must be declared and required, the specification must say that a repeated key returns the original result, and it must document a conflict response when the same key is reused with a different payload. Missing pieces become findings with suggested fixes. From there the generator builds seven cases covering an ordinary replay, a retry after a timeout, a retry after a 5xx response, two concurrent calls with the same key, a changed payload, a missing key, and a downstream record count. The last assertion is included when the API exposes a suitable collection endpoint.

Generated suites are available for ten common stacks. These include pytest with requests, Jest with fetch, Postman, curl with bash, k6, Playwright, Go, RSpec, JUnit 5, and xUnit. A full download contains the test plan, runner, local mock, deliberately broken mock, continuous integration job, risk register, and evidence bundle. The broken mock matters because it gives the team a quick way to prove that the assertions fail when deduplication is removed. The evidence bundle records the specification fingerprint, tool version, date, command, and result so it can be attached to a change ticket or incident review.

This is a focused tool for backend engineers, API platform teams, payment developers, and testers responsible for services where retries can duplicate an effect. It is especially useful during an API review because it evaluates what clients can learn from the published contract, then emits code in the stack the team already uses. The generator is deterministic and makes no model call at runtime. Operation and case identifiers follow fixed rules, and generated archives use fixed timestamps, so the same specification and stack produce the same bytes when the tool version is unchanged. That repeatability makes review and version comparison easier than a prose-only AI assessment.

The limits are stated clearly. A passing suite is evidence for the covered operations against the environment used on that date. It does not inspect server code, the database, production traffic, or endpoints missing from the specification. It cannot prove that an implementation matches its documentation, and it cannot test idempotency-key expiry unless a retention window is documented. The generated requests create records when aimed at a real service, so the vendor tells teams to use a sandbox and never production. This is also a correctness check rather than a load test or compliance certification. Those boundaries make the result useful without overstating what it establishes.

The free tier shows the three highest-risk operations in full and provides a downloadable starter suite with every stack available, without a card or account. A full audit costs AUD 99 once for one API and one team, unlocking every operation, all cases, the mocks, continuous integration job, risk register, and evidence bundle. The AUD 49 monthly plan adds browser-saved specifications, updated generators, and a drift gate that can fail a build when a required key or replay contract disappears. The vendor says it is not a hosted runner and suggests cancelling if the specification does not change or the team will not use the gate. That direct pricing and browser-local data path make the product easy to assess before paying.