REST API test cases, including the ones that leak another tenant

Authorisation is the category that produces real incidents, and it fails at the resource rather than at the route. A route guarded by a valid token is not the same as a resource owned by the caller, and the check that exists on the read path is frequently absent on the write path. The correct response for a resource belonging to someone else is 404 rather than 403, because 403 confirms that the identifier exists and turns a sequential identifier scheme into an enumeration tool. Mass assignment belongs in the same family: a create endpoint that accepts an owner or role field from the client has handed over the permission model.

Status codes carry contractual meaning that implementations routinely blur. A 200 with an empty object for a missing resource forces every consumer to write its own not found detection. Returning 403 where 401 belongs tells the caller nothing about how to recover. Treating PUT as a partial update leaves stale values in fields the client deliberately omitted. None of these throw an error, so they survive testing and then get built into every client that integrates.

Retries and concurrency are the two conditions that a sequential test suite cannot reach. HTTP clients retry automatically on timeout, so a create endpoint without idempotency key support will produce duplicate records in normal operation rather than under abuse. Two concurrent patches to different fields of the same resource should either both survive or be refused with a conflict, and the failure mode to test for is the silent loss of one of them.

Finally, the contract itself drifts, and error responses drift first. Success responses are usually validated against a specification somewhere; error bodies are hand written per branch and end up with inconsistent shapes, missing codes and occasionally a stack trace or query text that should never leave the server. Validating every response including failures against the published schema catches the drift, and it catches the breaking change that was released as a patch because the success path still looked fine.