pytest-api-core 1.0.5__tar.gz → 1.0.6__tar.gz

{pytest_api_core-1.0.5/src/pytest_api_core.egg-info → pytest_api_core-1.0.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pytest-api-core
-Version: 1.0.5
+Version: 1.0.6
 Summary: Pytest API automation framework with custom HTML reporting, reusable fixtures, and fluent assertions
 Author: QA Platform Team
 License: MIT License
@@ -84,6 +84,7 @@ Dynamic: license-file
 - **Configurable retry policy** — max attempts, backoff factor, and retryable methods, overridable per environment (see below)
 - **Environment config** — Python `settings.py` classes + `.env` file + env var overrides
 - **Custom HTML report** — self-contained file with charts, filterable table, and request/response details
+- **Secret redaction** — tokens, passwords, API keys and cookies are masked in logs, assertion messages, and the HTML report (see [Secret redaction](#secret-redaction))
 - **Auto-registered fixtures** — zero boilerplate in consuming projects
 
 ---
@@ -91,13 +92,13 @@ Dynamic: license-file
 ## Installation
 
 ```bash
-pip install pytest-api-core==1.0.5
+pip install pytest-api-core==1.1.0
 ```
 
 With `.env` file support (recommended):
 
 ```bash
-pip install "pytest-api-core[dotenv]==1.0.5"
+pip install "pytest-api-core[dotenv]==1.1.0"
 ```
 
 ---
@@ -183,6 +184,7 @@ something you'd want to toggle per environment).
 | `api_html_theme` | Report theme: `light` or `dark` | `dark` |
 | `api_html_title` | Report browser tab title | `API Test Report` |
 | `api_html_header` | Report page header text | `API Test Report` |
+| `api_redact_keys` | Extra header/JSON/query keys to redact (one per line) | — |
 
 ### CLI flags
 
@@ -216,6 +218,67 @@ redeclaring `api_client` — see [docs/QUICKSTART.md](docs/QUICKSTART.md#7-overr
 
 ---
 
+## Secret redaction
+
+Credentials never reach the raw logs (terminal, `log_cli`, `log_file`), assertion failure
+messages, or the HTML report — they are replaced with `***REDACTED***`. Redaction is on by
+default and works in three layers:
+
+1. **By key name** — values under any header, JSON key, query/form parameter, or `json_path`
+   segment whose name contains `token`, `secret`, `password`, `passwd`, `apikey`,
+   `authorization`, `cookie`, `credential`, or `privatekey` (case-insensitive, `-`/`_` ignored)
+   are masked. This covers `Authorization`, `X-API-Key`, `Set-Cookie`, `access_token`,
+   `client_secret`, `?api_key=…`, and so on.
+2. **By known value** — secrets the framework knows about are scrubbed wherever they appear,
+   even under an innocuous key: values passed to `BearerAuth`, `BasicAuth`, `APIKeyAuth`,
+   `OAuth2ClientCredentials` (including fetched access tokens), sensitive `default_headers`, and
+   the `API_TOKEN` / `API_PASSWORD` / `API_KEY_VALUE` env vars. `Bearer`/`Basic` credentials and
+   JWTs are always scrubbed from free text.
+3. **Final pass** — framework and urllib3 log lines, plus captured logs, stdout/stderr, and
+   tracebacks in the HTML report, are scrubbed before being written.
+
+Assertions on sensitive fields still work normally — only what is *displayed* is masked:
+
+```python
+assert_that(response).json_path("$.access_token").is_not_none()   # report shows ***REDACTED***
+assert_that(response).header_equals("X-Auth-Token", expected_token)
+```
+
+### Extending redaction
+
+```ini
+# pytest.ini — extra key names to treat as sensitive
+[pytest]
+api_redact_keys =
+    x-tenant-signature
+    otp
+```
+
+```python
+# conftest.py — register a secret obtained at runtime, or add keys programmatically
+from pytest_api_core import add_sensitive_keys, register_secret
+
+register_secret(session_token)          # scrubbed everywhere from now on
+add_sensitive_keys("x-tenant-signature")
+```
+
+Standalone helpers don't know key names, so pass `sensitive=True` to mask their values:
+
+```python
+assert_is_not_empty(token, sensitive=True)
+assert_equal(actual_secret, expected_secret, sensitive=True)
+```
+
+**Notes**
+
+- Masking is deliberately conservative: a key like `token_type` is masked too.
+- Registered secrets shorter than 4 characters are ignored, to avoid mangling unrelated output.
+- Plain `assert` statements are reported by pytest itself (assertion introspection), which the
+  framework can't intercept — prefer `assert_that(...)` / the `assert_*` helpers for secret
+  values, or `register_secret()` them so they're scrubbed from the HTML report.
+
+---
+
 ## Project structure
 
 ```
@@ -236,9 +299,11 @@ pytest-api-core-framework/
 │   │   └── env_loader.py       # .env file loading
 │   ├── fixtures/
 │   │   └── api_fixtures.py     # api_config, auth_provider, api_client, api_*_auth fixtures
-│   └── reporters/
-│       ├── html_reporter.py    # parses __API_CALL__/__API_ASSERT__ sentinels, renders HTML report
-│       └── templates/report.html
+│   ├── reporters/
+│   │   ├── html_reporter.py    # parses __API_CALL__/__API_ASSERT__ sentinels, renders HTML report
+│   │   └── templates/report.html
+│   └── security/
+│       └── redaction.py        # secret masking for logs, sentinels, assertion messages, report
 ├── tests/
 │   ├── unit/test_unit.py       # mocked HTTP tests (responses library)
 │   └── e2e/test_e2e_jsonplaceholder.py  # live tests against jsonplaceholder.typicode.com

{pytest_api_core-1.0.5 → pytest_api_core-1.0.6}/README.md

@@ -18,6 +18,7 @@
 - **Configurable retry policy** — max attempts, backoff factor, and retryable methods, overridable per environment (see below)
 - **Environment config** — Python `settings.py` classes + `.env` file + env var overrides
 - **Custom HTML report** — self-contained file with charts, filterable table, and request/response details
+- **Secret redaction** — tokens, passwords, API keys and cookies are masked in logs, assertion messages, and the HTML report (see [Secret redaction](#secret-redaction))
 - **Auto-registered fixtures** — zero boilerplate in consuming projects
 
 ---
@@ -25,13 +26,13 @@
 ## Installation
 
 ```bash
-pip install pytest-api-core==1.0.5
+pip install pytest-api-core==1.1.0
 ```
 
 With `.env` file support (recommended):
 
 ```bash
-pip install "pytest-api-core[dotenv]==1.0.5"
+pip install "pytest-api-core[dotenv]==1.1.0"
 ```
 
 ---
@@ -117,6 +118,7 @@ something you'd want to toggle per environment).
 | `api_html_theme` | Report theme: `light` or `dark` | `dark` |
 | `api_html_title` | Report browser tab title | `API Test Report` |
 | `api_html_header` | Report page header text | `API Test Report` |
+| `api_redact_keys` | Extra header/JSON/query keys to redact (one per line) | — |
 
 ### CLI flags
 
@@ -150,6 +152,67 @@ redeclaring `api_client` — see [docs/QUICKSTART.md](docs/QUICKSTART.md#7-overr
 
 ---
 
+## Secret redaction
+
+Credentials never reach the raw logs (terminal, `log_cli`, `log_file`), assertion failure
+messages, or the HTML report — they are replaced with `***REDACTED***`. Redaction is on by
+default and works in three layers:
+
+1. **By key name** — values under any header, JSON key, query/form parameter, or `json_path`
+   segment whose name contains `token`, `secret`, `password`, `passwd`, `apikey`,
+   `authorization`, `cookie`, `credential`, or `privatekey` (case-insensitive, `-`/`_` ignored)
+   are masked. This covers `Authorization`, `X-API-Key`, `Set-Cookie`, `access_token`,
+   `client_secret`, `?api_key=…`, and so on.
+2. **By known value** — secrets the framework knows about are scrubbed wherever they appear,
+   even under an innocuous key: values passed to `BearerAuth`, `BasicAuth`, `APIKeyAuth`,
+   `OAuth2ClientCredentials` (including fetched access tokens), sensitive `default_headers`, and
+   the `API_TOKEN` / `API_PASSWORD` / `API_KEY_VALUE` env vars. `Bearer`/`Basic` credentials and
+   JWTs are always scrubbed from free text.
+3. **Final pass** — framework and urllib3 log lines, plus captured logs, stdout/stderr, and
+   tracebacks in the HTML report, are scrubbed before being written.
+
+Assertions on sensitive fields still work normally — only what is *displayed* is masked:
+
+```python
+assert_that(response).json_path("$.access_token").is_not_none()   # report shows ***REDACTED***
+assert_that(response).header_equals("X-Auth-Token", expected_token)
+```
+
+### Extending redaction
+
+```ini
+# pytest.ini — extra key names to treat as sensitive
+[pytest]
+api_redact_keys =
+    x-tenant-signature
+    otp
+```
+
+```python
+# conftest.py — register a secret obtained at runtime, or add keys programmatically
+from pytest_api_core import add_sensitive_keys, register_secret
+
+register_secret(session_token)          # scrubbed everywhere from now on
+add_sensitive_keys("x-tenant-signature")
+```
+
+Standalone helpers don't know key names, so pass `sensitive=True` to mask their values:
+
+```python
+assert_is_not_empty(token, sensitive=True)
+assert_equal(actual_secret, expected_secret, sensitive=True)
+```
+
+**Notes**
+
+- Masking is deliberately conservative: a key like `token_type` is masked too.
+- Registered secrets shorter than 4 characters are ignored, to avoid mangling unrelated output.
+- Plain `assert` statements are reported by pytest itself (assertion introspection), which the
+  framework can't intercept — prefer `assert_that(...)` / the `assert_*` helpers for secret
+  values, or `register_secret()` them so they're scrubbed from the HTML report.
+
+---
+
 ## Project structure
 
 ```
@@ -170,9 +233,11 @@ pytest-api-core-framework/
 │   │   └── env_loader.py       # .env file loading
 │   ├── fixtures/
 │   │   └── api_fixtures.py     # api_config, auth_provider, api_client, api_*_auth fixtures
-│   └── reporters/
-│       ├── html_reporter.py    # parses __API_CALL__/__API_ASSERT__ sentinels, renders HTML report
-│       └── templates/report.html
+│   ├── reporters/
+│   │   ├── html_reporter.py    # parses __API_CALL__/__API_ASSERT__ sentinels, renders HTML report
+│   │   └── templates/report.html
+│   └── security/
+│       └── redaction.py        # secret masking for logs, sentinels, assertion messages, report
 ├── tests/
 │   ├── unit/test_unit.py       # mocked HTTP tests (responses library)
 │   └── e2e/test_e2e_jsonplaceholder.py  # live tests against jsonplaceholder.typicode.com

{pytest_api_core-1.0.5 → pytest_api_core-1.0.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pytest-api-core"
-version = "1.0.5"
+version = "1.0.6"
 description = "Pytest API automation framework with custom HTML reporting, reusable fixtures, and fluent assertions"
 readme = "README.md"
 license = { file = "LICENSE" }

{pytest_api_core-1.0.5 → pytest_api_core-1.0.6}/src/pytest_api_core/__init__.py

@@ -21,8 +21,9 @@ from pytest_api_core.auth.auth_handlers import (
 )
 from pytest_api_core.client.api_client import APIClient
 from pytest_api_core.client.api_response import APIResponse
+from pytest_api_core.security.redaction import add_sensitive_keys, register_secret
 
-__version__ = "1.0.0"
+__version__ = "1.1.0"
 __all__ = [
     "APIClient",
     "APIResponse",
@@ -38,4 +39,6 @@ __all__ = [
     "BasicAuth",
     "APIKeyAuth",
     "OAuth2ClientCredentials",
+    "register_secret",
+    "add_sensitive_keys",
 ]

pytest_api_core-1.0.6/src/pytest_api_core/assertions/assert_utils.py

@@ -0,0 +1,149 @@
+"""
+Generic, standalone string assertion utilities.
+
+Usage
+-----
+    from pytest_api_core.assertions import assert_equal
+
+    assert_equal(actual, expected)
+    assert_contains(actual, "substring")
+    assert_matches(actual, r"^\\d+$")
+    assert_matches_schema(actual, schema)
+    assert_is_not_empty(token, sensitive=True)   # value masked in logs/report
+
+Registered secrets (auth handler tokens, ``register_secret()``), Bearer
+credentials and JWTs are always scrubbed from sentinels and failure messages.
+Pass ``sensitive=True`` to mask the actual/expected values entirely.
+
+Unlike :class:`ResponseAssertions`, these are plain functions for comparing
+arbitrary actual/expected strings — not tied to an ``APIResponse``.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import re
+from typing import Any
+
+from pytest_api_core.security.redaction import mask, redact, schema_error_message
+
+_assert_log = logging.getLogger("pytest_api_core.assertions")
+
+
+def _emit(name: str, passed: bool, **detail: object) -> None:
+    """Emit a machine-readable sentinel line captured by HTMLReporter (secrets redacted)."""
+    _assert_log.debug(
+        "__API_ASSERT__ %s",
+        json.dumps({"name": name, "passed": passed, **redact(detail)}, separators=(",", ":")),
+    )
+
+
+def _fail(message: str | None, default: str) -> None:
+    raise AssertionError(f"{message}\n  {redact(default)}" if message else redact(default))
+
+
+def _show(value: Any, sensitive: bool) -> Any:
+    """Value as it may appear in sentinels and failure messages."""
+    return mask(value) if sensitive else value
+
+
+def assert_equal(
+    actual: str, expected: str, *, message: str | None = None, sensitive: bool = False
+) -> None:
+    """Assert *actual* equals *expected*."""
+    passed = actual == expected
+    shown_actual, shown_expected = _show(actual, sensitive), _show(expected, sensitive)
+    _emit("assert_equal", passed, expected=shown_expected, actual=shown_actual)
+    if not passed:
+        _fail(message, f"Expected {shown_expected!r}, got {shown_actual!r}.")
+
+
+def assert_not_equal(
+    actual: str, expected: str, *, message: str | None = None, sensitive: bool = False
+) -> None:
+    """Assert *actual* does not equal *expected*."""
+    passed = actual != expected
+    shown_actual, shown_expected = _show(actual, sensitive), _show(expected, sensitive)
+    _emit("assert_not_equal", passed, expected=shown_expected, actual=shown_actual)
+    if not passed:
+        _fail(message, f"Expected value to differ from {shown_expected!r}, got {shown_actual!r}.")
+
+
+def assert_equal_ignore_case(
+    actual: str, expected: str, *, message: str | None = None, sensitive: bool = False
+) -> None:
+    """Assert *actual* equals *expected*, ignoring case."""
+    passed = actual.lower() == expected.lower()
+    shown_actual, shown_expected = _show(actual, sensitive), _show(expected, sensitive)
+    _emit("assert_equal_ignore_case", passed, expected=shown_expected, actual=shown_actual)
+    if not passed:
+        _fail(message, f"Expected {shown_expected!r} (case-insensitive), got {shown_actual!r}.")
+
+
+def assert_contains(
+    actual: str, expected_substring: str, *, message: str | None = None, sensitive: bool = False
+) -> None:
+    """Assert *actual* contains *expected_substring*."""
+    passed = expected_substring in actual
+    shown_actual = _show(actual, sensitive)
+    shown_substring = _show(expected_substring, sensitive)
+    _emit("assert_contains", passed, expected_substring=shown_substring, actual=shown_actual)
+    if not passed:
+        _fail(message, f"Expected {shown_actual!r} to contain {shown_substring!r}.")
+
+
+def assert_matches(
+    actual: str, pattern: str, *, message: str | None = None, sensitive: bool = False
+) -> None:
+    """Assert *actual* matches the regex *pattern*."""
+    passed = re.search(pattern, actual) is not None
+    shown_actual = _show(actual, sensitive)
+    _emit("assert_matches", passed, pattern=pattern, actual=shown_actual)
+    if not passed:
+        _fail(message, f"Expected {shown_actual!r} to match /{pattern}/.")
+
+
+def assert_is_empty(actual: str, *, message: str | None = None, sensitive: bool = False) -> None:
+    """Assert *actual* is an empty string."""
+    passed = actual == ""
+    shown_actual = _show(actual, sensitive)
+    _emit("assert_is_empty", passed, actual=shown_actual)
+    if not passed:
+        _fail(message, f"Expected empty string, got {shown_actual!r}.")
+
+
+def assert_is_not_empty(
+    actual: str, *, message: str | None = None, sensitive: bool = False
+) -> None:
+    """Assert *actual* is a non-empty string."""
+    passed = actual != ""
+    _emit("assert_is_not_empty", passed, actual=_show(actual, sensitive))
+    if not passed:
+        _fail(message, "Expected non-empty string, got empty string.")
+
+
+def assert_matches_schema(
+    actual: object, schema: dict[str, Any], *, message: str | None = None
+) -> None:
+    """Assert *actual* conforms to the given JSON Schema, collecting all errors.
+
+    Values under sensitive keys (``token``, ``password``, …) are masked in the
+    sentinel's ``actual`` payload.
+    """
+    import jsonschema
+
+    validator = jsonschema.Draft7Validator(schema)
+    errors = sorted(validator.iter_errors(actual), key=lambda e: list(e.path))
+    passed = not errors
+    error_messages = [schema_error_message(e) for e in errors]
+    _emit(
+        "assert_matches_schema",
+        passed,
+        errors=error_messages,
+        schema=json.dumps(schema, indent=2, default=str),
+        actual=json.dumps(redact(actual), indent=2, default=str),
+    )
+    if not passed:
+        joined = "; ".join(error_messages)
+        _fail(message, f"Schema validation failed with {len(errors)} error(s): {joined}")

{pytest_api_core-1.0.5 → pytest_api_core-1.0.6}/src/pytest_api_core/assertions/response_assertions.py

@@ -22,15 +22,27 @@ import re
 from typing import Any
 
 from pytest_api_core.client.api_response import APIResponse
+from pytest_api_core.security.redaction import (
+    is_sensitive_key,
+    is_sensitive_path,
+    mask,
+    redact,
+    redact_headers,
+    redact_text,
+    redact_url,
+    schema_error_message,
+)
 
 _assert_log = logging.getLogger("pytest_api_core.assertions")
 
 
 def _emit(name: str, passed: bool, **detail: Any) -> None:
-    """Emit a machine-readable sentinel line captured by HTMLReporter."""
+    """Emit a machine-readable sentinel line captured by HTMLReporter (secrets redacted)."""
     _assert_log.debug(
         "__API_ASSERT__ %s",
-        json.dumps({"name": name, "passed": passed, **detail}, separators=(",", ":")),
+        json.dumps(
+            {"name": name, "passed": passed, **redact(detail)}, separators=(",", ":"), default=str
+        ),
     )
 
 
@@ -54,8 +66,8 @@ class ResponseAssertions:
         if not passed:
             raise AssertionError(
                 f"Expected status {expected}, got {actual}.\n"
-                f"  URL: {self._response.url}\n"
-                f"  Body: {self._response.response_body_text()[:500]}"
+                f"  URL: {self._safe_url()}\n"
+                f"  Body: {self._safe_body()[:500]}"
             )
         return self
 
@@ -66,7 +78,7 @@ class ResponseAssertions:
         _emit("status_in", passed, expected=list(expected), actual=actual)
         if not passed:
             raise AssertionError(
-                f"Expected status in {expected}, got {actual}.\n" f"  URL: {self._response.url}"
+                f"Expected status in {expected}, got {actual}.\n" f"  URL: {self._safe_url()}"
             )
         return self
 
@@ -78,8 +90,8 @@ class ResponseAssertions:
         if not passed:
             raise AssertionError(
                 f"Expected 2xx status, got {actual}.\n"
-                f"  URL: {self._response.url}\n"
-                f"  Body: {self._response.response_body_text()[:500]}"
+                f"  URL: {self._safe_url()}\n"
+                f"  Body: {self._safe_body()[:500]}"
             )
         return self
 
@@ -112,7 +124,7 @@ class ResponseAssertions:
         if not passed:
             raise AssertionError(
                 f"Expected header '{name}' to be present.\n"
-                f"  Headers: {dict(self._response.headers)}"
+                f"  Headers: {redact_headers(self._response.headers)}"
             )
         return self
 
@@ -120,9 +132,13 @@ class ResponseAssertions:
         """Assert header *name* equals *expected* (case-insensitive name match)."""
         actual = self._response.headers.get(name)
         passed = actual == expected
+        if is_sensitive_key(name):
+            expected, actual = mask(expected), mask(actual)
         _emit("header_equals", passed, header=name, expected=expected, actual=actual)
         if not passed:
-            raise AssertionError(f"Expected header '{name}' = {expected!r}, got {actual!r}.")
+            raise AssertionError(
+                f"Expected header '{name}' = {redact(expected)!r}, got {redact(actual)!r}."
+            )
         return self
 
     def content_type_contains(self, fragment: str) -> "ResponseAssertions":
@@ -146,7 +162,7 @@ class ResponseAssertions:
         if not passed:
             raise AssertionError(
                 f"Expected JSON key '{key}' to be present.\n"
-                f"  Body keys: {list(body.keys()) if isinstance(body, dict) else body}"
+                f"  Body keys: {list(body.keys()) if isinstance(body, dict) else redact(body)}"
             )
         return self
 
@@ -154,15 +170,20 @@ class ResponseAssertions:
         """Assert top-level JSON key *key* equals *expected*."""
         body = self._json_body()
         if not isinstance(body, dict):
-            raise AssertionError(f"Response body is not a JSON object: {body!r}")
+            raise AssertionError(f"Response body is not a JSON object: {redact(body)!r}")
         actual = body.get(key, _UNSET)
+        shown_expected = mask(expected) if is_sensitive_key(key) else expected
         if actual is _UNSET:
-            _emit("key_equals", False, key=key, expected=expected, actual="<missing>")
+            _emit("key_equals", False, key=key, expected=shown_expected, actual="<missing>")
             raise AssertionError(f"Key '{key}' not found in response body.")
         passed = actual == expected
-        _emit("key_equals", passed, key=key, expected=expected, actual=actual)
+        shown_actual = mask(actual) if is_sensitive_key(key) else actual
+        _emit("key_equals", passed, key=key, expected=shown_expected, actual=shown_actual)
         if not passed:
-            raise AssertionError(f"Expected body['{key}'] = {expected!r}, got {actual!r}.")
+            raise AssertionError(
+                f"Expected body['{key}'] = {redact(shown_expected)!r}, "
+                f"got {redact(shown_actual)!r}."
+            )
         return self
 
     def body_contains(self, text: str) -> "ResponseAssertions":
@@ -171,8 +192,8 @@ class ResponseAssertions:
         _emit("body_contains", passed, expected=text)
         if not passed:
             raise AssertionError(
-                f"Expected response body to contain {text!r}.\n"
-                f"  Body (first 300 chars): {self._response.text[:300]}"
+                f"Expected response body to contain {redact(text)!r}.\n"
+                f"  Body (first 300 chars): {redact_text(self._response.text)[:300]}"
             )
         return self
 
@@ -246,9 +267,11 @@ class ResponseAssertions:
         self._json_path_value = _UNSET
         self._json_path_path = None
         passed = actual == expected
+        if is_sensitive_path(path):
+            expected, actual = mask(expected), mask(actual)
         _emit("equals", passed, path=path, expected=expected, actual=actual)
         if not passed:
-            raise AssertionError(f"Expected {expected!r}, got {actual!r}.")
+            raise AssertionError(f"Expected {redact(expected)!r}, got {redact(actual)!r}.")
         return self
 
     def matches(self, pattern: str) -> "ResponseAssertions":
@@ -260,9 +283,10 @@ class ResponseAssertions:
         self._json_path_value = _UNSET
         self._json_path_path = None
         passed = re.search(pattern, actual) is not None
-        _emit("matches", passed, path=path, pattern=pattern, actual=actual)
+        shown = mask(actual) if is_sensitive_path(path) else redact(actual)
+        _emit("matches", passed, path=path, pattern=pattern, actual=shown)
         if not passed:
-            raise AssertionError(f"Expected value to match /{pattern}/, got {actual!r}.")
+            raise AssertionError(f"Expected value to match /{pattern}/, got {shown!r}.")
         return self
 
     def is_not_none(self) -> "ResponseAssertions":
@@ -274,7 +298,8 @@ class ResponseAssertions:
         self._json_path_value = _UNSET
         self._json_path_path = None
         passed = actual is not None
-        _emit("is_not_none", passed, path=path, actual=actual)
+        shown = mask(actual) if is_sensitive_path(path) else actual
+        _emit("is_not_none", passed, path=path, actual=shown)
         if not passed:
             raise AssertionError("Expected value to be non-null.")
         return self
@@ -296,7 +321,7 @@ class ResponseAssertions:
         if not passed:
             raise AssertionError(
                 f"Expected response time < {max_ms}ms, got {actual:.1f}ms.\n"
-                f"  URL: {self._response.url}"
+                f"  URL: {self._safe_url()}"
             )
         return self
 
@@ -315,8 +340,9 @@ class ResponseAssertions:
                 "jsonschema is required for schema validation: pip install jsonschema"
             )
         except jsonschema.ValidationError as exc:
-            _emit("matches_schema", False, actual=exc.message)
-            raise AssertionError(f"Schema validation failed: {exc.message}") from exc
+            detail = schema_error_message(exc)
+            _emit("matches_schema", False, actual=detail)
+            raise AssertionError(f"Schema validation failed: {detail}") from exc
         _emit("matches_schema", True)
         return self
 
@@ -331,9 +357,15 @@ class ResponseAssertions:
             raise AssertionError(
                 f"Response body is not valid JSON.\n"
                 f"  Status: {self._response.status_code}\n"
-                f"  Body: {self._response.text[:200]}"
+                f"  Body: {redact_text(self._response.text)[:200]}"
             ) from exc
 
+    def _safe_url(self) -> str:
+        return redact_url(self._response.url)
+
+    def _safe_body(self) -> str:
+        return redact_text(self._response.response_body_text())
+
 
 # ---------------------------------------------------------------------------
 # Sentinel & helpers
@@ -372,7 +404,7 @@ def _resolve_path(data: Any, path: str) -> Any:
             current = current[token]
         except (KeyError, IndexError, TypeError) as exc:
             raise AssertionError(
-                f"Path token {token!r} not found in {type(current).__name__}: {current!r}"
+                f"Path token {token!r} not found in {type(current).__name__}: {redact(current)!r}"
             ) from exc
     return current