A live REST API with tokens, pagination, validation and a few deliberately wrong status codes. Point Postman, curl, or your test framework at it and verify the contract.
Each token owns a separate copy of the data, so you cannot break anyone else's run. Tokens expire after 2 hours, and everything resets when the server restarts.
| POST | /api/practice/v1/token | Mint a token and an isolated dataset. No auth required. |
| GET | /api/practice/v1/bugs | List bugs. Supports page, limit, status, severity. |
| POST | /api/practice/v1/bugs | Create a bug. Body: { name, severity?, status?, area? } |
| GET | /api/practice/v1/bugs/:id | Fetch one bug. |
| PATCH | /api/practice/v1/bugs/:id | Partial update. |
| DELETE | /api/practice/v1/bugs/:id | Delete a bug. |
# 1. Mint a token (also creates your private dataset)
curl -s -X POST http://localhost:3000/api/practice/v1/token
# 2. Use it
TOKEN="paste_token_here"
curl -s http://localhost:3000/api/practice/v1/bugs \
-H "Authorization: Bearer $TOKEN"
# 3. Create one
curl -s -X POST http://localhost:3000/api/practice/v1/bugs \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name":"Cart badge does not update","severity":"major"}'Same endpoints you would hit from Postman or curl. Start by minting a token.
Work through these before revealing anything. Answers are opinions worth arguing with, not gospel.
Request a protected endpoint without a token. Which status code comes back, and is it correct?
sign in to trackCreate a bug with a missing required field. Is the validation error shaped usefully?
sign in to trackPage through the collection with ?page= and ?limit=. What happens past the last page, or with limit=0?
sign in to trackDELETE the same resource twice. Is the endpoint idempotent?
sign in to trackSend a PATCH with an unexpected field. Does the API reject it or silently accept it?
sign in to track