bmm-opencode 1.5.0 → 1.6.0

package/_bmad/tea/testarch/knowledge/api-testing-patterns.md

@@ -0,0 +1,851 @@
+# API Testing Patterns
+
+## Principle
+
+Test APIs and backend services directly without browser overhead. Use Playwright's `request` context for HTTP operations, `apiRequest` utility for enhanced features, and `recurse` for async operations. Pure API tests run faster, are more stable, and provide better coverage for service-layer logic.
+
+## Rationale
+
+Many teams over-rely on E2E/browser tests when API tests would be more appropriate:
+
+- **Slower feedback**: Browser tests take seconds, API tests take milliseconds
+- **More brittle**: UI changes break tests even when API works correctly
+- **Wrong abstraction**: Testing business logic through UI layers adds noise
+- **Resource heavy**: Browsers consume memory and CPU
+
+API-first testing provides:
+
+- **Fast execution**: No browser startup, no rendering, no JavaScript execution
+- **Direct validation**: Test exactly what the service returns
+- **Better isolation**: Test service logic independent of UI
+- **Easier debugging**: Clear request/response without DOM noise
+- **Contract validation**: Verify API contracts explicitly
+
+## When to Use API Tests vs E2E Tests
+
+| Scenario                  | API Test      | E2E Test      |
+| ------------------------- | ------------- | ------------- |
+| CRUD operations           | ✅ Primary    | ❌ Overkill   |
+| Business logic validation | ✅ Primary    | ❌ Overkill   |
+| Error handling (4xx, 5xx) | ✅ Primary    | ⚠️ Supplement |
+| Authentication flows      | ✅ Primary    | ⚠️ Supplement |
+| Data transformation       | ✅ Primary    | ❌ Overkill   |
+| User journeys             | ❌ Can't test | ✅ Primary    |
+| Visual regression         | ❌ Can't test | ✅ Primary    |
+| Cross-browser issues      | ❌ Can't test | ✅ Primary    |
+
+**Rule of thumb**: If you're testing what the server returns (not how it looks), use API tests.
+
+## Pattern Examples
+
+### Example 1: Pure API Test (No Browser)
+
+**Context**: Test REST API endpoints directly without any browser context.
+
+**Implementation**:
+
+```typescript
+// tests/api/users.spec.ts
+import { test, expect } from '@playwright/test';
+
+// No page, no browser - just API
+test.describe('Users API', () => {
+  test('should create user', async ({ request }) => {
+    const response = await request.post('/api/users', {
+      data: {
+        name: 'John Doe',
+        email: 'john@example.com',
+        role: 'user',
+      },
+    });
+
+    expect(response.status()).toBe(201);
+
+    const user = await response.json();
+    expect(user.id).toBeDefined();
+    expect(user.name).toBe('John Doe');
+    expect(user.email).toBe('john@example.com');
+  });
+
+  test('should get user by ID', async ({ request }) => {
+    // Create user first
+    const createResponse = await request.post('/api/users', {
+      data: { name: 'Jane Doe', email: 'jane@example.com' },
+    });
+    const { id } = await createResponse.json();
+
+    // Get user
+    const getResponse = await request.get(`/api/users/${id}`);
+    expect(getResponse.status()).toBe(200);
+
+    const user = await getResponse.json();
+    expect(user.id).toBe(id);
+    expect(user.name).toBe('Jane Doe');
+  });
+
+  test('should return 404 for non-existent user', async ({ request }) => {
+    const response = await request.get('/api/users/non-existent-id');
+    expect(response.status()).toBe(404);
+
+    const error = await response.json();
+    expect(error.code).toBe('USER_NOT_FOUND');
+  });
+
+  test('should validate required fields', async ({ request }) => {
+    const response = await request.post('/api/users', {
+      data: { name: 'Missing Email' }, // email is required
+    });
+
+    expect(response.status()).toBe(400);
+
+    const error = await response.json();
+    expect(error.code).toBe('VALIDATION_ERROR');
+    expect(error.details).toContainEqual(expect.objectContaining({ field: 'email', message: expect.any(String) }));
+  });
+});
+```
+
+**Key Points**:
+
+- No `page` fixture needed - only `request`
+- Tests run without browser overhead
+- Direct HTTP assertions
+- Clear error handling tests
+
+### Example 2: API Test with apiRequest Utility
+
+**Context**: Use enhanced apiRequest for schema validation, retry, and type safety.
+
+**Implementation**:
+
+```typescript
+// tests/api/orders.spec.ts
+import { test, expect } from '@seontechnologies/playwright-utils/api-request/fixtures';
+import { z } from 'zod';
+
+// Define schema for type safety and validation
+const OrderSchema = z.object({
+  id: z.string().uuid(),
+  userId: z.string(),
+  items: z.array(
+    z.object({
+      productId: z.string(),
+      quantity: z.number().positive(),
+      price: z.number().positive(),
+    }),
+  ),
+  total: z.number().positive(),
+  status: z.enum(['pending', 'processing', 'shipped', 'delivered']),
+  createdAt: z.string().datetime(),
+});
+
+type Order = z.infer<typeof OrderSchema>;
+
+test.describe('Orders API', () => {
+  test('should create order with schema validation', async ({ apiRequest }) => {
+    const { status, body } = await apiRequest<Order>({
+      method: 'POST',
+      path: '/api/orders',
+      body: {
+        userId: 'user-123',
+        items: [
+          { productId: 'prod-1', quantity: 2, price: 29.99 },
+          { productId: 'prod-2', quantity: 1, price: 49.99 },
+        ],
+      },
+      validateSchema: OrderSchema, // Validates response matches schema
+    });
+
+    expect(status).toBe(201);
+    expect(body.id).toBeDefined();
+    expect(body.status).toBe('pending');
+    expect(body.total).toBe(109.97); // 2*29.99 + 49.99
+  });
+
+  test('should handle server errors with retry', async ({ apiRequest }) => {
+    // apiRequest retries 5xx errors by default
+    const { status, body } = await apiRequest({
+      method: 'GET',
+      path: '/api/orders/order-123',
+      retryConfig: {
+        maxRetries: 3,
+        retryDelay: 1000,
+      },
+    });
+
+    expect(status).toBe(200);
+  });
+
+  test('should list orders with pagination', async ({ apiRequest }) => {
+    const { status, body } = await apiRequest<{ orders: Order[]; total: number; page: number }>({
+      method: 'GET',
+      path: '/api/orders',
+      params: { page: 1, limit: 10, status: 'pending' },
+    });
+
+    expect(status).toBe(200);
+    expect(body.orders).toHaveLength(10);
+    expect(body.total).toBeGreaterThan(10);
+    expect(body.page).toBe(1);
+  });
+});
+```
+
+**Key Points**:
+
+- Zod schema for runtime validation AND TypeScript types
+- `validateSchema` throws if response doesn't match
+- Built-in retry for transient failures
+- Type-safe `body` access
+
+### Example 3: Microservice-to-Microservice Testing
+
+**Context**: Test service interactions without browser - validate API contracts between services.
+
+**Implementation**:
+
+```typescript
+// tests/api/service-integration.spec.ts
+import { test, expect } from '@seontechnologies/playwright-utils/fixtures';
+
+test.describe('Service Integration', () => {
+  const USER_SERVICE_URL = process.env.USER_SERVICE_URL || 'http://localhost:3001';
+  const ORDER_SERVICE_URL = process.env.ORDER_SERVICE_URL || 'http://localhost:3002';
+  const INVENTORY_SERVICE_URL = process.env.INVENTORY_SERVICE_URL || 'http://localhost:3003';
+
+  test('order service should validate user exists', async ({ apiRequest }) => {
+    // Create user in user-service
+    const { body: user } = await apiRequest({
+      method: 'POST',
+      path: '/api/users',
+      baseUrl: USER_SERVICE_URL,
+      body: { name: 'Test User', email: 'test@example.com' },
+    });
+
+    // Create order in order-service (should validate user via user-service)
+    const { status, body: order } = await apiRequest({
+      method: 'POST',
+      path: '/api/orders',
+      baseUrl: ORDER_SERVICE_URL,
+      body: {
+        userId: user.id,
+        items: [{ productId: 'prod-1', quantity: 1 }],
+      },
+    });
+
+    expect(status).toBe(201);
+    expect(order.userId).toBe(user.id);
+  });
+
+  test('order service should reject invalid user', async ({ apiRequest }) => {
+    const { status, body } = await apiRequest({
+      method: 'POST',
+      path: '/api/orders',
+      baseUrl: ORDER_SERVICE_URL,
+      body: {
+        userId: 'non-existent-user',
+        items: [{ productId: 'prod-1', quantity: 1 }],
+      },
+    });
+
+    expect(status).toBe(400);
+    expect(body.code).toBe('INVALID_USER');
+  });
+
+  test('order should decrease inventory', async ({ apiRequest, recurse }) => {
+    // Get initial inventory
+    const { body: initialInventory } = await apiRequest({
+      method: 'GET',
+      path: '/api/inventory/prod-1',
+      baseUrl: INVENTORY_SERVICE_URL,
+    });
+
+    // Create order
+    await apiRequest({
+      method: 'POST',
+      path: '/api/orders',
+      baseUrl: ORDER_SERVICE_URL,
+      body: {
+        userId: 'user-123',
+        items: [{ productId: 'prod-1', quantity: 2 }],
+      },
+    });
+
+    // Poll for inventory update (eventual consistency)
+    const { body: updatedInventory } = await recurse(
+      () =>
+        apiRequest({
+          method: 'GET',
+          path: '/api/inventory/prod-1',
+          baseUrl: INVENTORY_SERVICE_URL,
+        }),
+      (response) => response.body.quantity === initialInventory.quantity - 2,
+      { timeout: 10000, interval: 500 },
+    );
+
+    expect(updatedInventory.quantity).toBe(initialInventory.quantity - 2);
+  });
+});
+```
+
+**Key Points**:
+
+- Multiple service URLs for microservice testing
+- Tests service-to-service communication
+- Uses `recurse` for eventual consistency
+- No browser needed for full integration testing
+
+### Example 4: GraphQL API Testing
+
+**Context**: Test GraphQL endpoints with queries and mutations.
+
+**Implementation**:
+
+```typescript
+// tests/api/graphql.spec.ts
+import { test, expect } from '@seontechnologies/playwright-utils/api-request/fixtures';
+
+const GRAPHQL_ENDPOINT = '/graphql';
+
+test.describe('GraphQL API', () => {
+  test('should query users', async ({ apiRequest }) => {
+    const query = `
+      query GetUsers($limit: Int) {
+        users(limit: $limit) {
+          id
+          name
+          email
+          role
+        }
+      }
+    `;
+
+    const { status, body } = await apiRequest({
+      method: 'POST',
+      path: GRAPHQL_ENDPOINT,
+      body: {
+        query,
+        variables: { limit: 10 },
+      },
+    });
+
+    expect(status).toBe(200);
+    expect(body.errors).toBeUndefined();
+    expect(body.data.users).toHaveLength(10);
+    expect(body.data.users[0]).toHaveProperty('id');
+    expect(body.data.users[0]).toHaveProperty('name');
+  });
+
+  test('should create user via mutation', async ({ apiRequest }) => {
+    const mutation = `
+      mutation CreateUser($input: CreateUserInput!) {
+        createUser(input: $input) {
+          id
+          name
+          email
+        }
+      }
+    `;
+
+    const { status, body } = await apiRequest({
+      method: 'POST',
+      path: GRAPHQL_ENDPOINT,
+      body: {
+        query: mutation,
+        variables: {
+          input: {
+            name: 'GraphQL User',
+            email: 'graphql@example.com',
+          },
+        },
+      },
+    });
+
+    expect(status).toBe(200);
+    expect(body.errors).toBeUndefined();
+    expect(body.data.createUser.id).toBeDefined();
+    expect(body.data.createUser.name).toBe('GraphQL User');
+  });
+
+  test('should handle GraphQL errors', async ({ apiRequest }) => {
+    const query = `
+      query GetUser($id: ID!) {
+        user(id: $id) {
+          id
+          name
+        }
+      }
+    `;
+
+    const { status, body } = await apiRequest({
+      method: 'POST',
+      path: GRAPHQL_ENDPOINT,
+      body: {
+        query,
+        variables: { id: 'non-existent' },
+      },
+    });
+
+    expect(status).toBe(200); // GraphQL returns 200 even for errors
+    expect(body.errors).toBeDefined();
+    expect(body.errors[0].message).toContain('not found');
+    expect(body.data.user).toBeNull();
+  });
+
+  test('should handle validation errors', async ({ apiRequest }) => {
+    const mutation = `
+      mutation CreateUser($input: CreateUserInput!) {
+        createUser(input: $input) {
+          id
+        }
+      }
+    `;
+
+    const { status, body } = await apiRequest({
+      method: 'POST',
+      path: GRAPHQL_ENDPOINT,
+      body: {
+        query: mutation,
+        variables: {
+          input: {
+            name: '', // Invalid: empty name
+            email: 'invalid-email', // Invalid: bad format
+          },
+        },
+      },
+    });
+
+    expect(status).toBe(200);
+    expect(body.errors).toBeDefined();
+    expect(body.errors[0].extensions.code).toBe('BAD_USER_INPUT');
+  });
+});
+```
+
+**Key Points**:
+
+- GraphQL queries and mutations via POST
+- Variables passed in request body
+- GraphQL returns 200 even for errors (check `body.errors`)
+- Test validation and business logic errors
+
+### Example 5: Database Seeding and Cleanup via API
+
+**Context**: Use API calls to set up and tear down test data without direct database access.
+
+**Implementation**:
+
+```typescript
+// tests/api/with-data-setup.spec.ts
+import { test, expect } from '@seontechnologies/playwright-utils/fixtures';
+
+test.describe('Orders with Data Setup', () => {
+  let testUser: { id: string; email: string };
+  let testProducts: Array<{ id: string; name: string; price: number }>;
+
+  test.beforeAll(async ({ request }) => {
+    // Seed user via API
+    const userResponse = await request.post('/api/users', {
+      data: {
+        name: 'Test User',
+        email: `test-${Date.now()}@example.com`,
+      },
+    });
+    testUser = await userResponse.json();
+
+    // Seed products via API
+    testProducts = [];
+    for (const product of [
+      { name: 'Widget A', price: 29.99 },
+      { name: 'Widget B', price: 49.99 },
+      { name: 'Widget C', price: 99.99 },
+    ]) {
+      const productResponse = await request.post('/api/products', {
+        data: product,
+      });
+      testProducts.push(await productResponse.json());
+    }
+  });
+
+  test.afterAll(async ({ request }) => {
+    // Cleanup via API
+    if (testUser?.id) {
+      await request.delete(`/api/users/${testUser.id}`);
+    }
+    for (const product of testProducts) {
+      await request.delete(`/api/products/${product.id}`);
+    }
+  });
+
+  test('should create order with seeded data', async ({ apiRequest }) => {
+    const { status, body } = await apiRequest({
+      method: 'POST',
+      path: '/api/orders',
+      body: {
+        userId: testUser.id,
+        items: [
+          { productId: testProducts[0].id, quantity: 2 },
+          { productId: testProducts[1].id, quantity: 1 },
+        ],
+      },
+    });
+
+    expect(status).toBe(201);
+    expect(body.userId).toBe(testUser.id);
+    expect(body.items).toHaveLength(2);
+    expect(body.total).toBe(2 * 29.99 + 49.99);
+  });
+
+  test('should list user orders', async ({ apiRequest }) => {
+    // Create an order first
+    await apiRequest({
+      method: 'POST',
+      path: '/api/orders',
+      body: {
+        userId: testUser.id,
+        items: [{ productId: testProducts[2].id, quantity: 1 }],
+      },
+    });
+
+    // List orders for user
+    const { status, body } = await apiRequest({
+      method: 'GET',
+      path: '/api/orders',
+      params: { userId: testUser.id },
+    });
+
+    expect(status).toBe(200);
+    expect(body.orders.length).toBeGreaterThanOrEqual(1);
+    expect(body.orders.every((o: any) => o.userId === testUser.id)).toBe(true);
+  });
+});
+```
+
+**Key Points**:
+
+- `beforeAll`/`afterAll` for test data setup/cleanup
+- API-based seeding (no direct DB access needed)
+- Unique emails to prevent conflicts in parallel runs
+- Cleanup after all tests complete
+
+### Example 6: Background Job Testing with Recurse
+
+**Context**: Test async operations like background jobs, webhooks, and eventual consistency.
+
+**Implementation**:
+
+```typescript
+// tests/api/background-jobs.spec.ts
+import { test, expect } from '@seontechnologies/playwright-utils/fixtures';
+
+test.describe('Background Jobs', () => {
+  test('should process export job', async ({ apiRequest, recurse }) => {
+    // Trigger export job
+    const { body: job } = await apiRequest({
+      method: 'POST',
+      path: '/api/exports',
+      body: {
+        type: 'users',
+        format: 'csv',
+        filters: { createdAfter: '2024-01-01' },
+      },
+    });
+
+    expect(job.id).toBeDefined();
+    expect(job.status).toBe('pending');
+
+    // Poll until job completes
+    const { body: completedJob } = await recurse(
+      () => apiRequest({ method: 'GET', path: `/api/exports/${job.id}` }),
+      (response) => response.body.status === 'completed',
+      {
+        timeout: 60000,
+        interval: 2000,
+        log: `Waiting for export job ${job.id} to complete`,
+      },
+    );
+
+    expect(completedJob.status).toBe('completed');
+    expect(completedJob.downloadUrl).toBeDefined();
+    expect(completedJob.recordCount).toBeGreaterThan(0);
+  });
+
+  test('should handle job failure gracefully', async ({ apiRequest, recurse }) => {
+    // Trigger job that will fail
+    const { body: job } = await apiRequest({
+      method: 'POST',
+      path: '/api/exports',
+      body: {
+        type: 'invalid-type', // This will cause failure
+        format: 'csv',
+      },
+    });
+
+    // Poll until job fails
+    const { body: failedJob } = await recurse(
+      () => apiRequest({ method: 'GET', path: `/api/exports/${job.id}` }),
+      (response) => ['completed', 'failed'].includes(response.body.status),
+      { timeout: 30000 },
+    );
+
+    expect(failedJob.status).toBe('failed');
+    expect(failedJob.error).toBeDefined();
+    expect(failedJob.error.code).toBe('INVALID_EXPORT_TYPE');
+  });
+
+  test('should process webhook delivery', async ({ apiRequest, recurse }) => {
+    // Trigger action that sends webhook
+    const { body: order } = await apiRequest({
+      method: 'POST',
+      path: '/api/orders',
+      body: {
+        userId: 'user-123',
+        items: [{ productId: 'prod-1', quantity: 1 }],
+        webhookUrl: 'https://webhook.site/test-endpoint',
+      },
+    });
+
+    // Poll for webhook delivery status
+    const { body: webhookStatus } = await recurse(
+      () => apiRequest({ method: 'GET', path: `/api/webhooks/order/${order.id}` }),
+      (response) => response.body.delivered === true,
+      { timeout: 30000, interval: 1000 },
+    );
+
+    expect(webhookStatus.delivered).toBe(true);
+    expect(webhookStatus.deliveredAt).toBeDefined();
+    expect(webhookStatus.responseStatus).toBe(200);
+  });
+});
+```
+
+**Key Points**:
+
+- `recurse` for polling async operations
+- Test both success and failure scenarios
+- Configurable timeout and interval
+- Log messages for debugging
+
+### Example 7: Service Authentication (No Browser)
+
+**Context**: Test authenticated API endpoints using tokens directly - no browser login needed.
+
+**Implementation**:
+
+```typescript
+// tests/api/authenticated.spec.ts
+import { test, expect } from '@seontechnologies/playwright-utils/fixtures';
+
+test.describe('Authenticated API Tests', () => {
+  let authToken: string;
+
+  test.beforeAll(async ({ request }) => {
+    // Get token via API (no browser!)
+    const response = await request.post('/api/auth/login', {
+      data: {
+        email: process.env.TEST_USER_EMAIL,
+        password: process.env.TEST_USER_PASSWORD,
+      },
+    });
+
+    const { token } = await response.json();
+    authToken = token;
+  });
+
+  test('should access protected endpoint with token', async ({ apiRequest }) => {
+    const { status, body } = await apiRequest({
+      method: 'GET',
+      path: '/api/me',
+      headers: {
+        Authorization: `Bearer ${authToken}`,
+      },
+    });
+
+    expect(status).toBe(200);
+    expect(body.email).toBe(process.env.TEST_USER_EMAIL);
+  });
+
+  test('should reject request without token', async ({ apiRequest }) => {
+    const { status, body } = await apiRequest({
+      method: 'GET',
+      path: '/api/me',
+      // No Authorization header
+    });
+
+    expect(status).toBe(401);
+    expect(body.code).toBe('UNAUTHORIZED');
+  });
+
+  test('should reject expired token', async ({ apiRequest }) => {
+    const expiredToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'; // Expired token
+
+    const { status, body } = await apiRequest({
+      method: 'GET',
+      path: '/api/me',
+      headers: {
+        Authorization: `Bearer ${expiredToken}`,
+      },
+    });
+
+    expect(status).toBe(401);
+    expect(body.code).toBe('TOKEN_EXPIRED');
+  });
+
+  test('should handle role-based access', async ({ apiRequest }) => {
+    // User token (non-admin)
+    const { status } = await apiRequest({
+      method: 'GET',
+      path: '/api/admin/users',
+      headers: {
+        Authorization: `Bearer ${authToken}`,
+      },
+    });
+
+    expect(status).toBe(403); // Forbidden for non-admin
+  });
+});
+```
+
+**Key Points**:
+
+- Token obtained via API login (no browser)
+- Token reused across all tests in describe block
+- Test auth, expired tokens, and RBAC
+- Pure API testing without UI
+
+## API Test Configuration
+
+### Playwright Config for API-Only Tests
+
+```typescript
+// playwright.config.ts
+import { defineConfig } from '@playwright/test';
+
+export default defineConfig({
+  testDir: './tests/api',
+
+  // No browser needed for API tests
+  use: {
+    baseURL: process.env.API_URL || 'http://localhost:3000',
+    extraHTTPHeaders: {
+      Accept: 'application/json',
+      'Content-Type': 'application/json',
+    },
+  },
+
+  // Faster without browser overhead
+  timeout: 30000,
+
+  // Run API tests in parallel
+  workers: 4,
+  fullyParallel: true,
+
+  // No screenshots/traces needed for API tests
+  reporter: [['html'], ['json', { outputFile: 'api-test-results.json' }]],
+});
+```
+
+### Separate API Test Project
+
+```typescript
+// playwright.config.ts
+export default defineConfig({
+  projects: [
+    {
+      name: 'api',
+      testDir: './tests/api',
+      use: {
+        baseURL: process.env.API_URL,
+      },
+    },
+    {
+      name: 'e2e',
+      testDir: './tests/e2e',
+      use: {
+        baseURL: process.env.APP_URL,
+        ...devices['Desktop Chrome'],
+      },
+    },
+  ],
+});
+```
+
+## Comparison: API Tests vs E2E Tests
+
+| Aspect              | API Test               | E2E Test                    |
+| ------------------- | ---------------------- | --------------------------- |
+| **Speed**           | ~50-100ms per test     | ~2-10s per test             |
+| **Stability**       | Very stable            | More flaky (UI timing)      |
+| **Setup**           | Minimal                | Browser, context, page      |
+| **Debugging**       | Clear request/response | DOM, screenshots, traces    |
+| **Coverage**        | Service logic          | User experience             |
+| **Parallelization** | Easy (stateless)       | Complex (browser resources) |
+| **CI Cost**         | Low (no browser)       | High (browser containers)   |
+
+## Related Fragments
+
+- `api-request.md` - apiRequest utility details
+- `recurse.md` - Polling patterns for async operations
+- `auth-session.md` - Token management
+- `contract-testing.md` - Pact contract testing
+- `test-levels-framework.md` - When to use which test level
+- `data-factories.md` - Test data setup patterns
+
+## Anti-Patterns
+
+**DON'T use E2E for API validation:**
+
+```typescript
+// Bad: Testing API through UI
+test('validate user creation', async ({ page }) => {
+  await page.goto('/admin/users');
+  await page.fill('#name', 'John');
+  await page.click('#submit');
+  await expect(page.getByText('User created')).toBeVisible();
+});
+```
+
+**DO test APIs directly:**
+
+```typescript
+// Good: Direct API test
+test('validate user creation', async ({ apiRequest }) => {
+  const { status, body } = await apiRequest({
+    method: 'POST',
+    path: '/api/users',
+    body: { name: 'John' },
+  });
+  expect(status).toBe(201);
+  expect(body.id).toBeDefined();
+});
+```
+
+**DON'T ignore API tests because "E2E covers it":**
+
+```typescript
+// Bad thinking: "Our E2E tests create users, so API is tested"
+// Reality: E2E tests one happy path; API tests cover edge cases
+```
+
+**DO have dedicated API test coverage:**
+
+```typescript
+// Good: Explicit API test suite
+test.describe('Users API', () => {
+  test('creates user', async ({ apiRequest }) => {
+    /* ... */
+  });
+  test('handles duplicate email', async ({ apiRequest }) => {
+    /* ... */
+  });
+  test('validates required fields', async ({ apiRequest }) => {
+    /* ... */
+  });
+  test('handles malformed JSON', async ({ apiRequest }) => {
+    /* ... */
+  });
+  test('rate limits requests', async ({ apiRequest }) => {
+    /* ... */
+  });
+});
+```