RequestFox Add to Chrome

How to run your API checks in CI

Build a suite of saved requests in RequestFox, choose ··· → Export as CI config, then Download the CLI. Commit both files and run node requestfox-ci.mjs assert --config requestfox.config.json in your pipeline: it sends every request for real, checks every rule, and exits non-zero on a failure.

Needs Node 18 or newer. For RequestFox 2.4.0.

A suite exported as a CI config: the dialog says what was saved and how to run it, with Download the CLI as its main button
Export as CI config, then Download the CLI.

Steps

  1. Make a suite

    Open Test suites from the top bar's ··· menu, name a suite and add saved requests as steps, in order. Add pass/fail checks on status, time, fields, headers or a JSON Schema.

  2. Export it as a CI config

    On the suite's card choose ··· → Export as CI config. You get requestfox.config.json: the steps, what each one extracts, saved auth and the checks that apply.

  3. Download the CLI

    Press Download the CLI in the same dialog. You get requestfox-ci.mjs: one file, no dependencies, shipped inside the extension.

  4. Commit both files

    Put them next to each other in your repository.

  5. Run it in the pipeline

    Add a step that runs node requestfox-ci.mjs assert --config requestfox.config.json --reporter junit --out results.xml and publish results.xml with your CI's JUnit report.

node requestfox-ci.mjs assert --config requestfox.config.json --reporter junit --out results.xml

Secrets stay out of the file

A secret-looking value typed into a body, a query or a header is written as {{env:NAME}}, and the dialog lists the names. Set them as CI secrets; the run stops before any request when one is missing.

More commands

  • diff --save-baseline, then diff: fail when an answer's shape changed since the baseline.
  • conform --spec openapi.yaml --session session.json: check a recorded session against your spec. How.
  • loadtest --vus 20 --duration 30s: a local load test from the same config.
  • probe --spec openapi.yaml --base http://localhost:3000: tests made from your spec. Each case breaks one rule (a wrong type, a missing field, a value out of range) and your API must refuse it with a 4xx; calls that need sign-in are also sent without it. Local APIs only unless you allow otherwise; reads only unless you allow otherwise.
  • mock --spec openapi.yaml: a mock API on 127.0.0.1 from your spec; --dynamic varies its answers, and --seed 42 repeats them.
  • --http2 on assert, diff, loadtest, run and probe: every request goes over HTTP/2, and a server that does not speak it is an error (HTTP/3 is out of scope).
  • --baseline known.json on assert, run, conform and probe: fail only on findings that are not in the file; --update-baseline writes it. explain RF-SLOW says why a finding code is flagged and what to do.
  • docs --workspace folder --out docs.html: your saved requests as one API docs page, with no request sent.

Run node requestfox-ci.mjs --help for every flag.

Next