API security tools: fuzz the contract you shipped (2026)

The 500 is on a field the OpenAPI file never named. The integration test used the happy example. Mean time to find it is often a contract problem wearing a coverage badge.

Six tools. Two contract linters you run on the file. Three fuzzers that turn that file into requests. One proxy that already sits in a lot of AppSec shops. Public pages, licenses, and one live thread. Not a bake-off. This is the tool shelf. The hatch walk is on API security testing.

Technical check: we cross-check first-party READMEs, SPDX licenses on GitHub as of 23 Aug 2026, and one live Hacker News thread. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.

1

CATS

Best for negative OpenAPI tests with no test code

Endava · repo opened 2020 · Apache-2.0

The README calls CATS a REST API fuzzer and negative testing tool for OpenAPI endpoints. It generates, runs, and reports tests with minimum configuration and no coding. Tests are self-healing. You point it at a spec and a live base URL you own.

Key features

• OpenAPI-driven generation. No handwritten test class for the first run
• Negative and boundary fuzzers, the class most example-based suites skip
• Java compiled to a native CLI with GraalVM, so it runs like any other binary
• Self-healing reports when the spec moves and the old case would rot

Why we like it

This is the honest first command on a new OpenAPI surface. If the pain is “we only ever POST the sample body,” CATS is built to send the values that sample never named. Apache-2.0. You operate it.

Limits

It is a fuzzer, not an authorization review. A 200 on a resource the caller should not see still needs the object-level check on IDOR. Their docs do not ship a Windows native binary. The uberjar wants Java 25 or newer. Latest tag we saw is cats-13.8.0 (1 Apr 2026). We did not run CATS against a third-party host.

2

Schemathesis

Best for property-based OpenAPI and GraphQL fuzz

schemathesis · repo opened 2019 · MIT

The README says it tests OpenAPI and GraphQL by generating inputs from your schema, adapting to server responses, and chaining operations into realistic workflows. It sits on Hypothesis. The first-party docs list 500s, schema violations, validation bypasses, and stateful bugs as the problems it is for.

Key features

• uvx schemathesis run against an OpenAPI URL, including their public demo
• pytest integration with schema.parametrize() and case.call_and_validate()
• Stateful mode via schema.as_state_machine() for create-then-get-then-delete
• GitHub Action schemathesis/action@v3, Allure and JUnit reports

Why we like it

If the team already writes Python tests, this is the fuzzer that lives next to them. The README names Spotify, WordPress, JetBrains, and Red Hat as users. Treat those as first-party claims. We did not interview those teams.

Limits

GraphQL and OpenAPI are the documented surfaces. gRPC is a requested gap. The author said so on Hacker News on 22 Mar 2024. A Python-shaped tool is a tax if the repo is only Go.

3

RESTler

Best for stateful sequences across a cloud API

Microsoft Research · repo opened 2020 · MIT

RESTler is the first stateful REST API fuzzer in their own words. It reads an OpenAPI definition, infers producer-consumer dependencies, and executes sequences that a single-request fuzzer never reaches. ICSE 2019 is the paper they ask you to cite. The repo still received commits on 10 Jun 2026.

Key features

• Compile, Test (smoketest), Fuzz-lean, then Fuzz, in that order
• Dependency inference so a GET does not fire before the POST that creates the id
• Checkers for 500s and for logic bugs such as leaks and hierarchy violations
• Replay logs when a bucketed bug lands. Docker and local .NET 8 builds

Why we like it

This is the fuzzer that cares about order. If the bug only appears after create-then-mutate, CATS and a stateless run can miss it. MIT. You operate it. A related Microsoft repo, REST API Fuzz Testing, is the CI-shaped sibling they point at.

Limits

Their own Fuzz mode warning is the one that matters: aggressive search can leak resources or degrade a poorly implemented service. Run Test first. They treat HTTP 500 as a bug. A 200 on a broken authorization check is a different class. Windows and Linux are first-class. macOS is experimental on the README.

4

vacuum

Best for fast Spectral-compatible spec lint

daveshanley · repo opened 2021 · MIT

vacuum is an OpenAPI, AsyncAPI, and JSON Schema linter. The README calls it fully compatible with existing Spectral rulesets and lists OpenAPI 3.0, 3.1, and 3.2. Install paths they publish: Homebrew cask, npm @quobix/vacuum, curl installer, Docker dshanley/vacuum.

Key features

• Spectral ruleset compatibility, so you do not rewrite the house style
• OpenAPI 3.2 on the banner, which older linters still skip
• CI note: set GITHUB_TOKEN on the curl installer so GitHub rate limits do not flake the job
• amd64 and arm64 Docker images, including Apple Silicon

Why we like it

Fuzzing a spec that already fails lint is how teams burn a night. vacuum is the preflight. MIT. You operate it.

Limits

It lints the file. It does not send a request. A clean vacuum run is not a clean API. Pair it with CATS or Schemathesis on a host you own. We ran @quobix/vacuum 0.27.0 (compiled 28 May 2026) on the fixture below. Exit 1. The unique-id miss is operation-operationId-unique.

5

Spectral

Best for the ruleset format the rest of the lint world copies

Stoplight · repo opened 2018 · Apache-2.0

Spectral is the OpenAPI and JSON linter whose ruleset format vacuum claims compatibility with. Apache-2.0. The repo opened in 2018 and was still pushing on 19 Aug 2026. If your org already has a .spectral.yaml, this is the source of that file, not a new religion.

Key features

• Custom rulesets you can share across services
• CLI and library shapes, the format CI snippets already assume
• JSON Schema and OpenAPI documents, not only one vendor layout
• The compatibility target for faster linters that do not want to fork your rules

Why we like it

A house ruleset is the only lint that survives a tool swap. Spectral is how that ruleset got a name. Keep it even if vacuum is the binary in CI.

Limits

It is a linter. Same door as vacuum: the file, not the live 500. Stoplight the company is not the same as a fuzz budget. Do not treat a green Spectral badge as authorization coverage.

6

OWASP ZAP

Best for a proxy scan after you import the spec

OWASP · Apache-2.0

ZAP is the known shelf. You import an OpenAPI definition, then spider and scan a host you own. The longer setup note is on how to secure your project with OWASP ZAP. It stays on this list because a lot of AppSec teams already have it, and the import is how it stops being a click-only browser proxy.

Key features

• OpenAPI import so the scan follows the contract, not only the UI
• Automation framework and packaged scans for CI
• Passive and active scan policies you can keep boring
• A desktop and a daemon, so the same engine can sit in a pipeline

Why we like it

The gem tools above do not replace a proxy that already sees the session cookie. ZAP is that proxy. Apache-2.0. You operate it.

Limits

An imported spec does not make ZAP a property-based fuzzer. It will not chain create-then-get the way RESTler does. It is also not an XSS sanitizer. Use it as the scan you already run, not as the only contract test.

What the internet thinks

Live threads. We quoted the argument, not the score.

Hacker NewsTheBigRoomXXL · 22 Mar 2024

I have been using Schemathesis for some time to test REST APIs and I have found it amazing. I love the ways it find unexpected bugs and it really help me have more confidence in my systems.

TheBigRoomXXL, 22 Mar 2024, on Ask HN: Any Good Fuzzer for gRPC? The rest of the thread is the missing gRPC cousin. dmitry_dygalo, who maintains Schemathesis, said he planned to add it. Until that lands, this list stays on OpenAPI.

Prove the lint door

Save this as openapi-dup.yaml. Two GET operations share operationId: getWidget. vacuum should refuse the file. Run it on a spec you own, not on a host you do not.

openapi: 3.0.3
info:
  title: widget-api
  version: 0.0.1
paths:
  /widget:
    get:
      operationId: getWidget
      responses:
        "200":
          description: ok
  /widget/{id}:
    get:
      operationId: getWidget
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: ok

vacuum lint openapi-dup.yaml
# expected: non-zero exit

FAQs

Can I skip the linter if I already fuzz?

No. A fuzz run on a spec that already fails lint wastes the night. vacuum or Spectral is the preflight. CATS, Schemathesis, or RESTler is the request. They are two doors.

Does Schemathesis replace CATS?

No. Schemathesis is Hypothesis in Python, including stateful workflows. CATS is a no-code negative fuzzer with a native CLI. You can run both on a host you own. You cannot skip object-level authorization because either one returned a 500.

Is RESTler safe on production?

Not in Fuzz mode. Their README says aggressive search can leak resources or degrade a poorly implemented service. Use Test, then Fuzz-lean, on an environment you own and can wipe.