I'm building a release pipeline and need smoke tests for APIs

A good API smoke test suite for a release pipeline should be:

• Fast: finishes in seconds to a few minutes
• Deterministic: avoids flaky external dependencies
• Critical-path only: validates the app is basically alive and the main endpoints work
• Safe: uses read-only or disposable test data whenever possible

What to include in API smoke tests

1) Health and readiness

These are the first checks.

• GET /health
• GET /ready
• Optional: GET /version or GET /build-info

Validate:

• HTTP 200
• response body format is correct
• build/version matches expected deploy artifact if available

2) Authentication

If your API requires auth, verify tokens and access work.

• POST /login or token exchange endpoint
• call one protected endpoint with the token

Validate:

• token issued successfully
• protected endpoint returns 200/403 as expected
• token expiration/claims are sane if relevant

3) Core business flow

Pick 1–3 most important paths only.

Examples:

• create resource
• fetch resource
• update resource
• delete resource

Typical pattern:

1. POST /items
2. GET /items/{id}
3. PATCH /items/{id}
4. DELETE /items/{id}

Validate:

• correct status codes
• response schema is valid
• resource lifecycle works end-to-end

4) Dependency sanity

Only if critical and cheap.

• DB-backed endpoint
• cache-backed endpoint
• message queue publish/consume trigger
• external dependency mocked or contract-tested, not full integration unless necessary

5) Basic error handling

One negative test per critical endpoint is enough.

• invalid input returns 400
• unauthorized returns 401/403
• missing resource returns 404

Recommended smoke test structure

A simple release gate might look like:

1. GET /health → 200
2. GET /ready → 200
3. Authenticate → success
4. GET /me or similar protected endpoint → 200
5. POST /resource → 201
6. GET /resource/{id} → 200
7. DELETE /resource/{id} → 204

Good practices

• Use a dedicated test account/tenant
• Clean up created data or use a disposable environment
• Keep tests idempotent where possible
• Add timeouts and retries sparingly for transient startup issues only
• Run smoke tests after deploy and before traffic shifting/approval
• Fail fast on the first critical error

Example cURL smoke test script

#!/usr/bin/env bash
set -euo pipefail

BASE_URL="${BASE_URL:-https://api.example.com}"

echo "Checking health..."
curl -fsS "$BASE_URL/health" | jq .

echo "Checking readiness..."
curl -fsS "$BASE_URL/ready" | jq .

echo "Authenticating..."
TOKEN=$(curl -fsS -X POST "$BASE_URL/login" \
  -H 'Content-Type: application/json' \
  -d '{"username":"smoke","password":"smoke-pass"}' | jq -r '.access_token')

test -n "$TOKEN" && test "$TOKEN" != "null"

echo "Calling protected endpoint..."
curl -fsS "$BASE_URL/me" \
  -H "Authorization: Bearer $TOKEN" | jq .

echo "Creating resource..."
RESOURCE_ID=$(curl -fsS -X POST "$BASE_URL/items" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"name":"smoke-test-item"}' | jq -r '.id')

test -n "$RESOURCE_ID" && test "$RESOURCE_ID" != "null"

echo "Fetching resource..."
curl -fsS "$BASE_URL/items/$RESOURCE_ID" \
  -H "Authorization: Bearer $TOKEN" | jq .

echo "Deleting resource..."
curl -fsS -X DELETE "$BASE_URL/items/$RESOURCE_ID" \
  -H "Authorization: Bearer $TOKEN" >/dev/null

echo "Smoke tests passed."

If you want a minimal smoke suite

Start with just:

• /health
• /ready
• one authenticated request
• one create/read request

That’s usually enough to catch broken deploys without slowing the pipeline.

If you want, I can also help you design:

1. a test checklist for your specific API,
2. a Postman/Newman collection,
3. or a GitHub Actions / Jenkins smoke test job.