# Generate API Happy Path Tests

API teams need fast proof that documented endpoints work together before deeper testing. This skill parses specifications, builds ordered flows, and generates Python scripts that exercise expected successful paths.

## Install

```bash
npx skillstore add chaim12345/happyflow-generator
```

## Metadata

- Status: approved
- Slug: chaim12345-happyflow-generator
- Skillstore revision: r1
- Version status: missing
- Tree hash: 3acff1e39c90c9af8cf374aa8cd59cea395b9f24444c5c227ecdd4e6a1502d06
- Author: Chaim12345
- GitHub username: Chaim12345
- License: MIT
- Repository: https://github.com/Chaim12345/happyflow-generator-skill/tree/main/skills/
- Ref: 02f077c174c5335e2f5d02ca15e77b70d9543e58
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, filesystem, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/chaim12345-happyflow-generator
- Manifest: https://skillstore.pages.dev/api/skills/chaim12345-happyflow-generator/manifest

## Capabilities

- Parses OpenAPI specifications from URLs or local files and extracts endpoints, schemas, request bodies, and base URLs.
- Creates authentication headers for bearer tokens, API keys, Basic auth, and OAuth2 client credentials.
- Builds a dependency-aware execution plan from path parameters, HTTP methods, and response schemas.
- Generates a Python API flow script with retries, response validation, summaries, and optional parallel execution.
- Runs the generated script with retries and returns the final script when requests succeed.

## Use Cases

- Validate a New API Contract: Generate a quick happy path script from an OpenAPI document before sharing the API with other teams.
- Prepare Regression Smoke Tests: Create ordered endpoint checks that confirm core API flows still return successful responses after changes.
- Check Deployment Readiness: Run a specification-based flow against a staging environment before promoting a release.

## Prompt Templates

### Generate a Basic Flow

```
Use happyflow-generator with this OpenAPI URL. Generate a sequential happy path test script and summarize the endpoint order before execution.
```

### Use Authentication Safely

```
Use this local OpenAPI file and bearer token. Show the base URL and endpoints first. Wait for confirmation before running requests.
```

### Debug Failed Happy Path Steps

```
Review the failed happy path output. Explain the failing step, likely request data issue, and the smallest change needed to retry.
```

### Harden Generated Tests

```
Generate the happy path script, then refactor it to avoid embedded secrets, use environment variables, and add clear target confirmation steps.
```

## Limitations

- It can run network requests and generated Python, so users must review targets and credentials first.
- GraphQL support is simplified and does not perform full schema introspection.
- Generated example values may fail against APIs with complex validation or business rules.
- It does not replace dedicated contract testing, security testing, or load testing tools.

## Best Practices

- Review the detected base URL, token URL, and endpoint list before allowing any request execution.
- Use staging credentials with limited permissions and redact secrets from generated scripts before sharing.
- Run generated scripts in a sandboxed environment with a minimal environment and strict network allowlist.

## Anti Patterns

- Do not run generated scripts against production systems without explicit approval and rate limits.
- Do not paste long-lived API keys into prompts or generated source files.
- Do not trust specifications from unknown URLs without reviewing server targets and examples first.

## Security Audit

- Audited at: 2026-07-05T06:37:08.474\+00:00
- Summary: The audit confirms real risks from generated Python execution, full environment inheritance, API credential handling, and outbound requests to user or specification controlled targets. Most Markdown fence detections and endpoint identifier findings are false positives. No prompt injection text was found, but publication should require sandboxing, target confirmation, and secret redaction.

## Stats

- Views: 218
- Downloads: 7
- Favorites: 0
- Popularity score: 0