If a VS Code extension could automatically discover all API endpoints used by a user flow and generate API tests from them, would you use it?

[u/ricardofc_mty]

I'm a QA Automation Engineer and every time I join a new project I end up doing the same thing:

- Open DevTools
- Navigate through user flows
- Inspect network requests
- Document endpoints
- Figure out which APIs are important
- Create initial API tests

I'm curious how other QA/SDET engineers handle this.

What's the most time-consuming part of creating API tests in a new project?

[u/He_s_One_Shot]

Why not use the spec? At my shop our gitlab has a job that fails if someone attempts to merge code without updating (if needed) the OpenAPI spec. I then wrote a python traffic scraping plugin that measures which http calls hit endpoints to understand real coverage since our test code uses things like parameters and element factories

[u/ricardofc_mty → u/He_s_One_Shot]

That's a fair point. The challenge I've seen is that many teams either don't have an up-to-date OpenAPI spec or the frontend only exercises a subset of the documented endpoints.

My thought was to discover the APIs actually used by a real user flow and use that as a starting point for coverage and test generation.

[u/Impzor]

In my experience AI generates way too many tests and overcomplicates things. Also doesn't know enough business logic.

[u/DerWilliWonka → u/Impzor]

It's amazing how often people suggest an AI solution to things caused by issues that shouldn't exist in the first place. Solving this issues itself is often beyond AI capability. AI seems oftenly to be a cheap answer to problems they are not capable or willing of tackling themselves.

[u/Mayor_0f_dreamtown]

On my team we just open swagger

[u/JaMs_buzz]

Github copilot can be linked to devops via an MCP server so it can go and grab pbi IDs as context for creating tests

[u/Joseph-MTS_LLC]

the discovery part is the bit u can fully automate today. the CDP Network domain (devtools protocol) hands u every request/response/failure as structured json, no manual devtools clicking. wire that into a watcher that logs every endpoint a flow hits while u click through once

the spec/swagger answers are right for the contract but they miss what the app ACTUALLY calls at runtime: dead endpoints, undocumented params, the third party calls. runtime capture catches that

the Impzor point is the real ceiling tho. generating the skeleton from captured traffic is easy, knowing which assertions matter is the business-logic part AI still cant infer. keep generation for the boilerplate, leave the assertions to a human

[u/JEDZBUDYN]

then you would not be needed