1.2The Analysis Pipeline

OpenAPI Schema (YAML/JSON)
    |
    v
+---------------------------+
|  AI SCHEMA ANALYZER       |
|                           |
| 1. Parse endpoints        |
| 2. Extract constraints    |
| 3. Identify edge cases    |
| 4. Map auth requirements  |
| 5. Detect undocumented    |
|     patterns              |
+----------+----------------+
           |
           v
+---------------------------+
|  TEST GENERATOR           |
|                           |
|  Per endpoint:            |
|  - Happy path tests       |
|  - Validation tests       |
|  - Auth tests             |
|  - Boundary tests         |
|  - Error code tests       |
+---------------------------+

Step 1: Parse Endpoints

Extract every path + method combination:

def parse_endpoints(spec: dict) -> list[Endpoint]:
    endpoints = []
    for path, methods in spec["paths"].items():
        for method, details in methods.items():
            if method in ("get", "post", "put", "patch", "delete"):
                endpoints.append(Endpoint(
                    path=path,
                    method=method.upper(),
                    summary=details.get("summary", ""),
                    parameters=details.get("parameters", []),
                    request_body=details.get("requestBody"),
                    responses=details.get("responses", {}),
                    security=details.get("security", []),
                ))
    return endpoints

Step 2: Extract Constraints

For each field in request bodies and parameters, identify testable constraints:

Schema Property	Test Cases Generated
required: true	Test with field missing, null, empty
type: string	Test with number, boolean, array, object
minLength: 1	Test with empty string, 1-char string
maxLength: 200	Test with 200 chars, 201 chars
minimum: 0	Test with -1, 0, 1
maximum: 100	Test with 99, 100, 101
format: uuid	Test with valid UUID, invalid UUID, empty
format: email	Test with valid email, invalid email
enum: [a, b, c]	Test each value + one invalid value
pattern: "^[A-Z]{3}$"	Test matching and non-matching strings

Step 3: Map Auth Requirements

# Schema defines auth per endpoint:
security:
  - BearerAuth: [admin]

# This generates tests:
# 1. Valid admin token → 200
# 2. Valid user token (wrong role) → 403
# 3. Expired token → 401
# 4. Missing token → 401
# 5. Malformed token → 401