You have API tests.
API Qortex tells you whether they're any good — and gives you everything to fix it.
Send a request like any client. Then get a verdict on the testing behind it: coverage gaps, missing auth paths, assertions that only check a status code. Self-hosted, on your own infrastructure.
status equals 200
responseTime lessThan 2000
$.data.id exists
// not asserted:
// 401 path · schema · $.data.total type
// $.data.items[] length · headers
and grade the testing behind it
13 Aug 2026
Quality
The part no other API tool does. Grade what you have, enforce standards, keep them alive, fill the gaps, prove it.
Point it at anything.
Get a verdict.
Upload a file, pick an existing project, fetch from a URL, or compare two collections. 33 analyzers grade what they find and group every issue by impact: Blockers, Reliability, Correctness, Completeness and Quality.
Assertion Policies 12 categories · 37 rules
Rules that auto-apply to every test during execution. Pick a ready-made preset, or switch to Custom Selection for control over every assertion type, operator and value. Click any category below to see its rules.
Presets 7 coverage presets
Applied at project level, so every test inherits them. Or switch to Custom Mode for full control over all 12 categories and 37 individual rules. Separately, the test editor offers 6 one-click assertion bundles — Quick Check, Standard, Thorough, Contract, Security and Performance — for adding assertions to a single test.
Assertion Types 31 types · 10 categories
Build by clicking, or drop into custom JavaScript. Multiple operators per type across the ten categories.
Your API changed.
Your tests didn't break.
Fields get renamed, moved, split or retyped. The healing engine detects the change, proposes the corrected assertion, and applies it automatically only when it is confident enough.
Coverage gaps
become datasets.
Upload a CSV, or generate data across ten categories including injection, unicode, boundary and type violation. Every row runs as its own case.
Reports 7 types
Each answers a different question, all generated from the same run data. Pick a type, scope it to one project or all projects, choose a format and generate.
Functional Test Report
Per-test pass/fail with failure grouping, error messages and stack traces.
Performance Report
Response time percentiles, throughput and k6 load-test output with AI bottleneck analysis.
Security Report
Passive OWASP findings, active payload results and ZAP deep-scan output by CWE category.
Contract Report
Schema violations against OpenAPI specs, with $ref resolution and version diffing.
Health Report
Overall project health with AI-written narrative summary across runs.
Quality Report
Coverage scoring, assertion depth and the five-tier issue classification.
CI/CD Export
JUnit XML, JSON and TAP output for pipeline integration with GitHub Actions, GitLab CI and Jenkins.
Quality, visible at a glance
Pass-rate trend, response percentiles, failure grouping and regression detection across every suite.
Build & Run
Everything you need to construct a request, chain it, script it and execute it — across four protocols.
Core capabilities
Visual Test Builder
Point-and-click assertions, headers, auth and body configuration with instant visual feedback. No code required.
API Playground
Params, Headers, Body, Auth, Scripts, Tests, Cookies and AI Analysis. Eight body types: JSON, form-urlencoded, form-data, XML, HTML, text, raw and none.
gRPC Workspace
Dedicated surface with proto loading, alongside REST, GraphQL and WebSocket. Four protocols, one platform.
GraphQL
Introspection, type-name resolution, query depth and fragment-reuse analysis built into the analyzers.
WebSocket
Full tester with auto-reconnect and 1,245 lines of dedicated UI. Nine auth selectors, with bearer, basic and API key wired into the connect handshake.
Project Hierarchy
Projects → Suites → Tests with categories, drag-and-drop ordering and nested navigation.
9 Auth Types + Inheritance
Bearer, Basic, API Key, OAuth 2.0, Digest, Hawk, NTLM, AWS Signature V4, plus none. Project-to-test inheritance with 401 auto-refresh and token caching.
5-Level Variable Scoping
Builtins → chained → suite → environment → global. Narrowest wins. Auto-extract tokens from responses; dynamic values always beat the store.
Multi-Environment
Dev, Staging, Production variables per project. Switch instantly without editing tests.
Pre/Post Scripts
Postman-compatible pm.* API with CryptoJS, lodash, dateFns, uuid, pm.sendRequest() and pm.execution.setNextRequest().
Cookie Jar
Full cookie lifecycle across requests, with its own dedicated test suite.
Three-Level Execution
Run a single test, a whole suite, or batch across suites. SSE streaming shows each result as it lands, with dependsOn chains and skipIfDepFailed.
QortexLab Practice API
Built-in companion API with 142 endpoints and 13 modules. Learn, test and demo with no external dependency.
Saved Responses
Capture and keep responses for comparison, mocking and later inspection.
Import 7 parsers
Every import is graded before it lands. AI pre-analysis, auto-detect, script extraction and a four-step wizard.
Testing disciplines 8 areas
One platform instead of six.
Functional
CRUD, validation, error handling, pagination, filtering, sorting
Security
Injection, auth bypass, data exposure, rate limiting
Performance
Response time, throughput, concurrency, spike profiles
Contract
Schema validation, backward compatibility, type checking
Monitoring
Health checks, availability, latency tracking
Integration
Multi-step workflows, data passing, dependency ordering
Protocol
Four transports, one test model
Automation
Pipelines, scheduled runs, webhook triggers
Intelligence
Analysis is deterministic and repeatable. AI adds explanation, suggestion and conversation on top — never in place of the verdict.
AI capabilities 24 integration points
AI Analysis
Every failed test gets root cause analysis, severity rating, category tags and step-by-step fix suggestions.
Intelligent Verdict
Reviews entire responses holistically, not just assertions, catching subtle issues rules miss.
Field Observations
Per-field data quality: anomalies, missing values, format inconsistencies, unexpected patterns.
Test Suggestions
Recommends additional cases based on API structure, response patterns and coverage gaps.
Ask Qortex
Chat that knows your projects, runs and results. Contextual answers from your own data, with sources.
Import Analysis
Pre-analyses imported collections: quality score, coverage gaps, auth detection, recommendations.
Test Data Generation
Datasets across ten categories including injection, unicode, boundary and type violation.
Healing Suggestions
Proposes assertion repairs when response structure drifts, with before and after.
Report Narratives
Written summaries on Health and Quality reports, generated from run data.
Load Test Analysis
Reads k6 output and explains where the bottleneck is.
Security Analysis
Interprets scanner findings and ranks real risk over noise.
Model Discovery
Detects available models per provider so configuration stays current.
Seven providers. Switch per feature, or chain them with automatic fallback.
PII never reaches
a cloud model.
Self-hosting is table stakes. This is what makes it mean something: when a cloud provider is in the chain, sensitive values are masked before the prompt leaves your server, then restored in the response.
What no one else has
Smart Execution
Three-level execution: single test, suite, or batch across suites. SSE streaming shows every result as it lands, with dependsOn chains and skipIfDepFailed for ordering.
Smart Knowledge Base
Upload your company’s API docs as PDF, DOCX or MD. The RAG pipeline chunks, indexes and makes them searchable via AI chat, with source citations.
Smart Scripts
Full Postman-compatible pm.* API. pm.test(), pm.expect(), CryptoJS, lodash, dateFns, uuid, pm.sendRequest() for auxiliary calls, pm.execution.setNextRequest() for dynamic flow.
Operations
Scheduling, monitoring, security scanning, load testing, contracts, access control and audit — everything needed to run this in production.
Enterprise capabilities
Schedules
Cron-based runs with timezone support and in-app notifications when something breaks.
Webhooks & CI/CD
Trigger runs from GitHub Actions, GitLab CI, Jenkins or any webhook, with token-scoped access.
Contract Testing
Validate against OpenAPI specs with $ref resolution, AJV, five violation types and versioned contract schemas.
Security Scanning
Three engines: passive OWASP checks, active payload probing with 44 payloads across 6 CWE categories, and ZAP deep scan in its own container.
Performance Testing
k6-driven load testing with six profiles, live SSE dashboards, thresholds and checks captured per run.
API Monitoring
Uptime and SLA tracking, four alert types, 90-day timeline, per-monitor trend and check history.
Role-Based Access
Database-backed roles at global and project scope, fully configurable permissions, cascade-safe deletes.
Audit Trail
Every create, update and delete logged with user, timestamp, entity type and action.
Data Retention
Configurable retention policy with scheduled maintenance to keep history bounded.
CLI Runner
Three commands, five reporters: Console, JUnit XML, JSON, HTML and TAP.
Notifications
In-app notification centre with deep links straight to the failing run.
Security Hardening
SSRF guards with permanent cloud-metadata blocking (169.254.169.254), an Allow Private URLs toggle, a 10-hop redirect cap, CSRF protection, rate limiting, JWT secret management and script sandboxing.
Platform
Extensibility, collaboration, portability and the stack it all runs on.
Platform capabilities
Plugins
Extend execution with your own logic through a registered plugin executor and registry.
Real-Time Presence
See who else is online and which test or suite they are viewing. SSE-powered presence indicators with automatic stale-session cleanup.
YAML Import / Export
Git-friendly project export and import, so suites can live in your repository.
Custom Dashboards
Build your own dashboard from the metrics you care about.
Knowledge Base
Upload API docs as PDF, DOCX or MD. RAG indexing makes them searchable and answerable in chat.
Code Generation
Generate runnable code in 8 languages from any request: cURL, JavaScript (fetch), Python (requests), Java (HttpClient), Go (net/http), Ruby (Net::HTTP), PHP (cURL) and C# (HttpClient).
Help Center
109 built-in articles across 12 categories, searchable, with AI chat over the whole corpus.
Docker Deployment
Six services via Docker Compose: Postgres, Ollama, ZAP, app, nginx, certbot. Persistent volumes, health checks, auto-restart.
Stack verified at 56a9d4d
Deploy with Docker Compose on any VPS. Six services, persistent volumes, health checks, auto-restart. Nothing leaves your network.
See what your tests are actually worth
Runs entirely on your own infrastructure. Nothing leaves your server.