schemathesis 4.0.21__tar.gz → 4.0.23__tar.gz

{schemathesis-4.0.21 → schemathesis-4.0.23}/CHANGELOG.md

@@ -1,6 +1,19 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.21...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.23...HEAD) - TBD
+
+## [4.0.23](https://github.com/schemathesis/schemathesis/compare/v4.0.22...v4.0.23) - 2025-08-07
+
+### :bug: Fixed
+
+- False positives in `ensure_resource_availability` check by limiting it to 404 responses only.
+
+## [4.0.22](https://github.com/schemathesis/schemathesis/compare/v4.0.21...v4.0.22) - 2025-08-07
+
+### :bug: Fixed
+
+- Parameter overrides replacing all explicit examples instead of merging with them. [#3000](https://github.com/schemathesis/schemathesis/issues/3000)
+- Escape examples for path parameters. [#3003](https://github.com/schemathesis/schemathesis/issues/3003)
 
 ## [4.0.21](https://github.com/schemathesis/schemathesis/compare/v4.0.20...v4.0.21) - 2025-08-04
 

{schemathesis-4.0.21 → schemathesis-4.0.23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.0.21
+Version: 4.0.23
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.0.21 → schemathesis-4.0.23}/docs/guides/extending.md

@@ -22,7 +22,7 @@ Replace random generated data with realistic values that work with your test env
 import schemathesis
 
 @schemathesis.hook  
-def map_query(context, query):
+def map_query(ctx, query):
     """Replace random user_id with a known test user"""
     if query and "user_id" in query:
         query["user_id"] = "test-user-123"
@@ -69,7 +69,7 @@ filter_* → map_* → flatmap_* → Final test case
 
 ```python
 @schemathesis.hook
-def filter_query(context, query):
+def filter_query(ctx, query):
     return query and query.get("user_id") != "admin"
 ```
 
@@ -79,7 +79,7 @@ def filter_query(context, query):
 
 ```python
 @schemathesis.hook
-def map_path_parameters(context, path_parameters):
+def map_path_parameters(ctx, path_parameters):
     if path_parameters and "product_id" in path_parameters:
         path_parameters["product_id"] = "product_1"
     return path_parameters
@@ -93,7 +93,7 @@ def map_path_parameters(context, path_parameters):
 from hypothesis import strategies as st
 
 @schemathesis.hook
-def flatmap_body(context, body):
+def flatmap_body(ctx, body):
     if body and "email" in body and "organization" in body:
         org = body["organization"]
         domain = f"{org.lower()}.com"
@@ -161,7 +161,7 @@ Define your hooks:
 import schemathesis
 
 @schemathesis.hook
-def map_headers(context, headers):
+def map_headers(ctx, headers):
     if headers is None:
         headers = {}
     headers["X-Test-Mode"] = "true"
@@ -198,14 +198,14 @@ Apply hooks only to certain API endpoints:
 ```python
 # Only apply to user endpoints, skip POST requests
 @schemathesis.hook.apply_to(path_regex=r"/users/").skip_for(method="POST")
-def map_headers(context, headers):
+def map_headers(ctx, headers):
     headers = headers or {}
     headers["X-User-Context"] = "test-user"
     return headers
 
 # Only apply to a specific operation
 @schemathesis.hook.apply_to(name="GET /orders/{order_id}")
-def map_path_parameters(context, path_parameters):
+def map_path_parameters(ctx, path_parameters):
     path_parameters = path_parameters or {}
     path_parameters["order_id"] = "order_12345"  # Known test order
     return path_parameters
@@ -217,7 +217,7 @@ For complex scenarios, modify the entire request:
 
 ```python
 @schemathesis.hook
-def before_call(context, case, **kwargs):
+def before_call(ctx, case, **kwargs):
     """Modify the request just before it's sent"""
     # Add correlation ID for tracing
     case.headers["X-Correlation-ID"] = f"test-{uuid.uuid4()}"
@@ -231,7 +231,7 @@ def before_call(context, case, **kwargs):
 
 ```python
 @schemathesis.hook
-def before_init_operation(context, operation):
+def before_init_operation(ctx, operation):
     """Remove optional properties to focus tests on required fields only"""
     for parameter in operation.iter_parameters():
         schema = parameter.definition.get("schema", {})
@@ -271,7 +271,7 @@ GraphQL hooks work with `graphql.DocumentNode` objects instead of JSON data. The
 
 ```python
 @schemathesis.hook
-def map_body(context, body):
+def map_body(ctx, body):
     """Change field names in the GraphQL query"""
     node = body.definitions[0].selection_set.selections[0]
     
@@ -287,7 +287,7 @@ Use `map_query` to provide variables:
 
 ```python
 @schemathesis.hook
-def map_query(context, query):
+def map_query(ctx, query):
     """Add query parameters to GraphQL requests"""
     return {"q": "42"}
 ```
@@ -298,7 +298,7 @@ Note that `query` is always `None` for GraphQL requests since Schemathesis doesn
 
 ```python
 @schemathesis.hook
-def filter_body(context, body):
+def filter_body(ctx, body):
     """Skip queries with specific field names"""
     node = body.definitions[0].selection_set.selections[0]
     return node.name.value != "excludeThisField"
@@ -310,7 +310,7 @@ def filter_body(context, body):
 from hypothesis import strategies as st
 
 @schemathesis.hook
-def flatmap_body(context, body):
+def flatmap_body(ctx, body):
     """Generate dependent fields based on query content"""
     node = body.definitions[0].selection_set.selections[0]
     if node.name.value == "someField":

{schemathesis-4.0.21 → schemathesis-4.0.23}/docs/guides/stateful-testing.md

@@ -49,7 +49,7 @@ class APIWorkflow(schema.as_state_machine()):
 
     def before_call(self, case):
         """Modify every request in the sequence."""
-        
+
     def after_call(self, response, case):
         """Process every response."""
 

{schemathesis-4.0.21 → schemathesis-4.0.23}/docs/reference/hooks.md

@@ -34,7 +34,7 @@ Hooks that execute during test case execution.
 
 | Hook | Signature | Execution Stage | Purpose |
 |------|-----------|-----------------|---------|
-| **before_call** | `(ctx, case: Case) -> None` | Before HTTP request | Modify test case (headers, body, etc.) |
+| **before_call** | `(ctx, case: Case, **kwargs) -> None` | Before HTTP request | Modify test case (headers, body, etc.) |
 | **process_call_kwargs** | `(ctx, case: Case, kwargs: dict) -> dict` | Before `case.call()` | Modify request library arguments (timeout, verify, etc.) |
 | **after_call** | `(ctx, case: Case, response: Response) -> None` | After HTTP response | Inspect/modify response before checks |
 

{schemathesis-4.0.21 → schemathesis-4.0.23}/docs/resources.md

@@ -1,6 +1,16 @@
 # External Resources
 
-This page collects articles, papers, videos, and tutorials about Schemathesis written by the community. These resources provide additional perspectives, use cases, and implementation examples.
+This page collects articles, papers, videos, tutorials, and integrations about Schemathesis written by the community. These resources provide additional perspectives, use cases, and implementation examples.
+
+## Integrations
+
+- [Robot Framework SchemathesisLibrary](https://github.com/aaltat/robotframework-schemathesis) by **@aaltat**
+
+    - **Description**: Robot Framework integration with Schemathesis. Automatically generates test cases from OpenAPI/GraphQL schemas using DataDriver integration.
+
+    - **Documentation**: [Keyword documentation](https://aaltat.github.io/robotframework-schemathesis/SchemathesisLibrary.html)
+
+    - **Installation**: `pip install robotframework-schemathesislibrary`
 
 ## Papers
 
@@ -26,6 +36,12 @@ This page collects articles, papers, videos, and tutorials about Schemathesis wr
 
 ## Articles
 
+- [Introduction to Schemathesis: A Tool for Automatic Test Data Generation for Web APIs](https://gihyo.jp/article/2025/07/monthly-python-2507) (in Japanese) by **@ryu22e**
+
+    - **Description**: A great introduction to Schemathesis 4 that covers both CLI usage and pytest integration with many practical examples.
+
+    - **Date**: Jul 2025
+
 - [Create a Cracker of an Open API Contract with VS Code, Spectral, Prism and Schemathesis](https://blog.hungovercoders.com/datagriff/2023/12/22/create-a-cracker-of-an-open-api-contract-with-vs-code-spectral-prism-and-schemathesis.html) by **@dataGriff**
 
     - **Description**: Detailed walkthrough of contract-first API design and testing workflow.

{schemathesis-4.0.21 → schemathesis-4.0.23}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.0.21"
+version = "4.0.23"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.0.21 → schemathesis-4.0.23}/src/schemathesis/hooks.py

@@ -395,7 +395,7 @@ def hook(hook: str | Callable) -> Callable:
                 return query and "user_id" in query
 
             @schemathesis.hook
-            def before_call(ctx, case):
+            def before_call(ctx, case, **kwargs):
                 \"\"\"Modify headers before sending each request\"\"\"
                 if case.headers is None:
                     case.headers = {}

{schemathesis-4.0.21 → schemathesis-4.0.23}/src/schemathesis/specs/openapi/_hypothesis.py

@@ -301,6 +301,8 @@ def generate_parameter(
     if value == explicit:
         # When we pass `explicit`, then its parts are excluded from generation of the final value
         # If the final value is the same, then other parameters were generated at all
+        if value is not None and location == "path":
+            value = quote_all(value)
         used_generator = None
     return ValueContainer(value=value, location=location, generator=used_generator)
 

{schemathesis-4.0.21 → schemathesis-4.0.23}/src/schemathesis/specs/openapi/checks.py

@@ -408,8 +408,11 @@ def ensure_resource_availability(ctx: CheckContext, response: Response, case: Ca
     if not isinstance(case.operation.schema, BaseOpenAPISchema) or is_unexpected_http_status_case(case):
         return True
 
-    # First, check if this is a 4XX response
-    if not (400 <= response.status_code < 500):
+    # Only check for 404 (Not Found) responses - other 4XX are not resource availability issues
+    # 422 / 400: Validation errors (bad request data)
+    # 401 / 403: Auth issues (expired tokens, permissions)
+    # 409: Conflict errors
+    if response.status_code != 404:
         return None
 
     parent = ctx._find_parent(case_id=case.id)

{schemathesis-4.0.21 → schemathesis-4.0.23}/src/schemathesis/specs/openapi/examples.py

@@ -51,6 +51,20 @@ class BodyExample:
 Example = Union[ParameterExample, BodyExample]
 
 
+def merge_kwargs(left: dict[str, Any], right: dict[str, Any]) -> dict[str, Any]:
+    mergeable_keys = {"path_parameters", "headers", "cookies", "query"}
+
+    for key, value in right.items():
+        if key in mergeable_keys and key in left:
+            if isinstance(left[key], dict) and isinstance(value, dict):
+                # kwargs takes precedence
+                left[key] = {**left[key], **value}
+                continue
+        left[key] = value
+
+    return left
+
+
 def get_strategies_from_examples(
     operation: APIOperation[OpenAPIParameter], **kwargs: Any
 ) -> list[SearchStrategy[Case]]:
@@ -72,7 +86,7 @@ def get_strategies_from_examples(
     # Add examples from parameter's schemas
     examples.extend(extract_from_schemas(operation))
     return [
-        openapi_cases(operation=operation, **{**parameters, **kwargs, "phase": TestPhase.EXAMPLES}).map(
+        openapi_cases(operation=operation, phase=TestPhase.EXAMPLES, **merge_kwargs(parameters, kwargs)).map(
             serialize_components
         )
         for parameters in produce_combinations(examples)

schemathesis-4.0.23/test/cli/__snapshots__/test_checks/test_ensure_resource_availability_does_not_trigger_on_subsequent_error.raw

@@ -0,0 +1,43 @@
+Exit code: 0
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from http://127.0.0.1/openapi.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/
+     Specification:    Open API 3.1.0
+     Operations:       2 selected / 2 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✓
+
+ ✅  Stateful (in 0.00s)
+
+     Scenarios:    N
+     API Links:    N covered / 1 selected / 1 total
+
+     ✅ N passed
+
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 2/2
+  Tested: 2
+
+Test Phases:
+  ⏭  Examples (disabled)
+  ⏭  Coverage (disabled)
+  ⏭  Fuzzing (disabled)
+  ✅ Stateful
+
+Test cases:
+  N generated, N passed
+
+Seed: 42
+
+=========================== No issues found in 1.00s ===========================

{schemathesis-4.0.21 → schemathesis-4.0.23}/test/cli/test_checks.py

@@ -243,3 +243,112 @@ def test_not_a_server_error(cli, snapshot_cli, openapi3_schema_url):
         )
         == snapshot_cli
     )
+
+
+def test_ensure_resource_availability_does_not_trigger_on_subsequent_error(app_runner, cli, snapshot_cli):
+    app = Flask(__name__)
+
+    organizations = {}
+    next_id = 1
+
+    @app.route("/openapi.json")
+    def openapi():
+        return {
+            "openapi": "3.1.0",
+            "info": {"title": "Test API", "version": "0.1.0"},
+            "paths": {
+                "/organizations/": {
+                    "post": {
+                        "operationId": "organizations:create",
+                        "requestBody": {
+                            "content": {
+                                "application/json": {
+                                    "schema": {
+                                        "type": "object",
+                                        "properties": {"name": {"type": "string"}},
+                                        "required": ["name"],
+                                    }
+                                }
+                            },
+                            "required": True,
+                        },
+                        "responses": {
+                            "201": {
+                                "description": "Created",
+                                "headers": {"Location": {"schema": {"type": "string"}}},
+                                "links": {
+                                    "create_project": {
+                                        "operationId": "organizations:projects:create",
+                                        "parameters": {
+                                            "organization_id": "$response.body#/id",
+                                        },
+                                    }
+                                },
+                            }
+                        },
+                    }
+                },
+                "/organizations/{organization_id}/projects/": {
+                    "post": {
+                        "operationId": "organizations:projects:create",
+                        "parameters": [
+                            {"name": "organization_id", "in": "path", "required": True, "schema": {"type": "integer"}}
+                        ],
+                        "requestBody": {
+                            "content": {
+                                "application/json": {
+                                    "schema": {
+                                        "type": "object",
+                                        "properties": {"name": {"type": "string"}},
+                                        "required": ["name"],
+                                    }
+                                }
+                            },
+                            "required": True,
+                        },
+                        "responses": {
+                            "201": {"description": "Created"},
+                            "422": {"description": "Unprocessable Content"},
+                        },
+                    }
+                },
+            },
+        }
+
+    @app.route("/organizations/", methods=["POST"])
+    def create_organization():
+        nonlocal next_id
+        data = request.get_json()
+        if not isinstance(data, dict):
+            return jsonify({"error": "Must be object"}), 422
+        if "name" not in data:
+            return jsonify({"error": "Name is missing"}), 422
+
+        organizations[next_id] = data
+        response = jsonify({"id": next_id, "name": data["name"]})
+        next_id += 1
+        return response, 201
+
+    @app.route("/organizations/<int:organization_id>/projects/", methods=["POST"])
+    def create_sub(organization_id):
+        if organization_id not in organizations:
+            return jsonify({"error": "Not found"}), 404
+
+        data = request.get_json()
+        if not isinstance(data, dict):
+            return jsonify({"error": "Must be object"}), 422
+
+        return jsonify({"id": 1}), 201
+
+    port = app_runner.run_flask_app(app)
+
+    assert (
+        cli.run(
+            f"http://127.0.0.1:{port}/openapi.json",
+            "-c ensure_resource_availability",
+            "--max-examples=50",
+            "--phases=stateful",
+            "--continue-on-failure",
+        )
+        == snapshot_cli
+    )

schemathesis-4.0.23/test/specs/openapi/__snapshots__/test_examples/test_config_override_with_examples.raw

@@ -0,0 +1,60 @@
+Exit code: 1
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from /tmp/schema.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/api
+     Specification:    Open API 3.0.2
+     Operations:       1 selected / 1 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✘
+
+ ❌  Examples (in 0.00s)
+
+     ❌ 1 failed
+
+=================================== FAILURES ===================================
+_______________________ PUT /{primary}/subs/{secondary} ________________________
+1. Test Case ID: <PLACEHOLDER>
+
+- Undocumented HTTP status code
+
+    Received: 404
+    Documented: 201
+
+[404] Not Found:
+
+    `404: Not Found`
+
+Reproduce with:
+
+    curl -X PUT -H 'Content-Type: application/json' -d '{"property": "whatever"}' http://127.0.0.1/api/primary/subs/whatever
+
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 1/1
+  Tested: 1
+
+Test Phases:
+  ❌ Examples
+  ⏭  Coverage (disabled)
+  ⏭  Fuzzing (disabled)
+  ⏭  Stateful (disabled)
+
+Failures:
+  ❌ Undocumented HTTP status code: 1
+
+Test cases:
+  N generated, N found N unique failures
+
+Seed: 42
+
+============================== 1 failure in 1.00s ==============================

schemathesis-4.0.23/test/specs/openapi/__snapshots__/test_examples/test_path_parameters_example_escaping.raw

@@ -0,0 +1,60 @@
+Exit code: 1
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from /tmp/schema.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/api
+     Specification:    Open API 3.0.2
+     Operations:       1 selected / 1 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✘
+
+ ❌  Examples (in 0.00s)
+
+     ❌ 1 failed
+
+=================================== FAILURES ===================================
+___________________________ GET /networks/{network} ____________________________
+1. Test Case ID: <PLACEHOLDER>
+
+- Undocumented HTTP status code
+
+    Received: 404
+    Documented: 202
+
+[404] Not Found:
+
+    `404: Not Found`
+
+Reproduce with:
+
+    curl -X GET http://127.0.0.1/api/networks/fd00%3A%3A%2F64
+
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 1/1
+  Tested: 1
+
+Test Phases:
+  ❌ Examples
+  ⏭  Coverage (disabled)
+  ⏭  Fuzzing (disabled)
+  ⏭  Stateful (disabled)
+
+Failures:
+  ❌ Undocumented HTTP status code: 1
+
+Test cases:
+  N generated, N found N unique failures
+
+Seed: 42
+
+============================== 1 failure in 1.00s ==============================

{schemathesis-4.0.21 → schemathesis-4.0.23}/test/specs/openapi/test_examples.py

@@ -1671,3 +1671,83 @@ def test_find_matching_in_responses_yields_all():
 
 def test_find_matching_in_responses_empty():
     assert list(find_matching_in_responses({}, "id")) == []
+
+
+def test_config_override_with_examples(ctx, cli, snapshot_cli, openapi3_base_url):
+    # See GH-3000
+    schema_file = ctx.openapi.write_schema(
+        {
+            "/{primary}/subs/{secondary}": {
+                "put": {
+                    "parameters": [
+                        {"name": "primary", "in": "path", "schema": {"type": "string"}, "required": True},
+                        {
+                            "name": "secondary",
+                            "in": "path",
+                            "schema": {"type": "string"},
+                            "example": "whatever",
+                            "required": True,
+                        },
+                    ],
+                    "requestBody": {
+                        "required": True,
+                        "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Schema"}}},
+                    },
+                    "responses": {"201": {"description": "OK"}},
+                }
+            },
+        },
+        components={
+            "schemas": {
+                "Schema": {
+                    "type": "object",
+                    "properties": {"property": {"schema": {"type": "string"}, "example": "whatever"}},
+                }
+            }
+        },
+    )
+    assert (
+        cli.main(
+            "run",
+            str(schema_file),
+            "--phases=examples",
+            f"--url={openapi3_base_url}",
+            config={"parameters": {"path.primary": "primary"}},
+        )
+        == snapshot_cli
+    )
+
+
+def test_path_parameters_example_escaping(ctx, cli, snapshot_cli, openapi3_base_url):
+    # See GH-3003
+    schema_file = ctx.openapi.write_schema(
+        {
+            "/networks/{network}": {
+                "get": {
+                    "parameters": [
+                        {
+                            "name": "network",
+                            "in": "path",
+                            "required": True,
+                            "schema": {
+                                "type": "string",
+                                "format": "ipv6-network",
+                                "example": "fd00::/64",
+                            },
+                        },
+                    ],
+                    # Set `202` to trigger a failure
+                    "responses": {"202": {"description": "Ok"}},
+                }
+            }
+        }
+    )
+
+    result = cli.main(
+        "run",
+        str(schema_file),
+        "--phases=examples",
+        f"--url={openapi3_base_url}",
+    )
+
+    assert result == snapshot_cli