DOCSEARCHbyAlgolia
Submit Docs

Dochia API Testing Tool

website·Indexed 33 days ago

https://docs.dochia.dev

An API testing tool for generating and executing negative, boundary, and fuzz tests from OpenAPI specifications. Dochia provides a CLI for test execution, custom mutators for extended fuzzing capabilities, and strategies for analyzing error patterns such as SQL injection and authentication flaws. It supports CI/CD integration, enterprise deployment patterns, and detailed reporting for API security and quality assurance.

Tokens
59.8K
Snippets
375
Records
460
Agent score
49%

What's inside Dochia

  1. Overview of Dochia API Testing

    Dochia is an OpenAPI-first API testing tool that automatically generates and executes negative and boundary tests to find edge cases, security vulnerabilities, and robustness issues. Unlike traditional tools that focus on 'happy paths', Dochia uses over 100 playbooks to systematically test how an API handles invalid input.

    Key capabilities include:

    • Automatic test generation from OpenAPI specs (no manual writing).
    • Native binary distribution (no Java runtime required).
    • Support for OpenAPI 3.0, 3.1, and Swagger 2.0 in YAML or JSON formats.

  2. Overview of Dochia API Testing

    Dochia is an API testing tool that automatically generates and executes negative and boundary tests based on an OpenAPI specification. Unlike standard 'happy path' testing, Dochia focuses on identifying edge cases, security vulnerabilities, and robustness issues by sending intentionally malformed, invalid, or unexpected requests to verify input validation, error handling, and security boundaries.

  3. Overview of Dochia generated agent skills

    Dochia generates a specific skill file for each primary CLI command to enable AI agents to perform the following tasks:

    • dochia-test: Run systematic API tests, manage profiles, set quality gates, and parse reports.
    • dochia-fuzz: Launch continuous random fuzzing and set stop conditions.
    • dochia-replay: Replay errors/warnings from previous runs for re-validation.
    • dochia-list: Discover available playbooks, profiles, mutators, paths, and formats.
    • dochia-explain: Explain response codes, playbooks, and error reasons from reports.

    The dochia-test skill includes references/report-output.md containing JSON schemas for TestN.json and dochia-summary-report.json, along with jq recipes for analysis.

  4. Overview of Fuzzing in Dochia

    Fuzzing in Dochia is a testing technique that sends random, unexpected, or invalid data to an API to discover vulnerabilities, crashes, or unexpected behaviors. Unlike structured playbooks, fuzzing uses 28 different mutators to generate unpredictable test cases, making it ideal for exploratory testing, security research, and finding edge cases.

  5. Overview of Dochia Playbooks

    Playbooks are automated test scenarios in Dochia designed to systematically uncover vulnerabilities, edge cases, and implementation issues in an API. They generate test data based on the provided OpenAPI specification, send crafted payloads, and analyze the responses. Dochia includes over 100 built-in playbooks divided into three categories:

    1. Field Playbooks: Test individual request fields (e.g., boundary testing, data type validation, Unicode/character testing, size/structure, and advanced field testing like mass assignment).
    2. Header Playbooks: Test HTTP header handling and security (e.g., header injection, content negotiation, security headers, and load testing via large header counts).
    3. Body Playbooks: Test request body handling and general behavior (e.g., authentication bypass, undocumented HTTP methods, malformed JSON, and 'Happy Path' testing).

  6. Overview of Dochia Playbook Categories

    Dochia uses playbooks to systematically test different aspects of an API. Playbooks are categorized by the specific area of the request they target, allowing developers to apply targeted testing strategies for bodies, fields, headers, and fuzzing logic.

  7. Understand GraalVM native binary constraints in Dochia

    Dochia is distributed as native binaries compiled with GraalVM. This architecture eliminates the need for a Java runtime but limits runtime reflection to what is determined at compile time. This may impact custom authentication scripts using reflection, dynamic payload generation with complex object hierarchies, and runtime class loading for custom extensions.

  8. Retrieve system and installation information using `dochia info`

    The dochia info command displays a table of system information about the Dochia installation and the current environment. This is primarily used for troubleshooting, generating bug reports, and verifying the environment setup. The output includes:

    System Information

    • OS Name: Operating system name (e.g., Mac OS X, Linux, Windows)
    • OS Version: Operating system version number
    • OS Arch: System architecture (x86_64, arm64, etc.)

    Dochia Information

    • Binary Type: Packaging method (uber-jar, native-image)
    • Dochia Version: Current version of the Dochia CLI
    • Dochia Build: Build timestamp in ISO format

    Terminal Information

    • Term Width: Current terminal width in characters
    • Term Type: Terminal type identifier
    • Shell: Path to the current shell executable
    dochia info

  9. Detect Information Disclosure vulnerabilities

    Use the --error-keywords flag with a properties file containing keywords like Exception, Traceback, or secret to find leaked internal architecture or credentials in API responses.
    # Look for information leakage
dochia test --contract api.yml --server https://api.example.com \
  --error-keywords info-disclosure-keywords.properties

    info-disclosure-keywords.properties

    Exception Error Traceback at java at com. password token key secret debug trace verbose dump stack trace internal error

  10. Get details on system components with `dochia explain`

    The explain command provides detailed information about specific playbooks, mutators, response codes, or error reasons.
    # Explain a specific response code
dochia explain --type response_code 953

# Explain an error reason
dochia explain --type error_reason "Error details leak"

  11. Initialize Dochia agent skills for AI IDEs

    Dochia supports AI-powered IDEs (Windsurf, Cursor, Claude Code, OpenAI Codex) via the Agent Skills specification. Running the initialization command generates structured markdown files in .agents/skills/ that teach the AI assistant about Dochia's commands, flags, and output formats. These skills are automatically discovered by supported IDEs at the start of a session.
    # Generate agent skills in the current project
dochia init-skills

# Or generate skills in a specific directory
dochia init-skills --dir /path/to/project

# Commit the generated skills to version control
git add .agents/
git commit -m "Add Dochia agent skills"

  12. Explain Dochia mutators

    Use the mutator type to learn about input types, mutation strategies, randomization, and usage context for a specific mutator. Use dochia list --mutators to find available mutators.
    # List available mutators
dochia list --mutators

# Explain a specific mutator
dochia explain --type mutator RandomLargeDecimalsMutator