API smoke testing: verify critical paths before they reach production

What is smoke testing?

Smoke testing is a shallow, fast validation technique that verifies critical functionality works after a code change, deployment, or environment setup. The term originates from hardware testing: plug in the device and check if it smokes. For APIs, it means hitting key endpoints to confirm they respond correctly before running deeper tests.

Unlike comprehensive functional testing, smoke tests don't validate business logic or edge cases. They answer a binary question: Is the system stable enough to proceed? If authentication fails, there's no point running payment tests. If the health check endpoint returns 500, stop the deployment.

Why smoke testing matters in modern development

Continuous deployment pipelines push code multiple times per day. Running a full test suite (which can take 30-60 minutes) on every commit creates bottlenecks. Smoke tests act as a deployment gate: they run in 2-5 minutes and catch showstopper issues immediately.

Industry adoption

• Google: Runs smoke tests on every Kubernetes cluster deployment to verify core services are reachable before routing production traffic.
• Stripe: Payment API smoke tests run every 2 minutes in production to detect outages within seconds of occurrence.
• Shopify: Post-deployment smoke tests verify checkout, cart, and auth endpoints before marking a release as healthy.
• Netflix: Uses smoke tests as pre-chaos validation — if smoke fails, chaos experiments don't run.

When to run smoke tests

What to include in a smoke test suite

Smoke tests should be fast, critical, and simple. Focus on endpoints that would halt business operations if broken.

Essential endpoints to test

1. Health/readiness endpoints — GET /health, GET /ready
2. Authentication — POST /auth/login, token validation
3. Core CRUD operations — Create, Read, Update for primary resources
4. Payment processing — POST /payments (if applicable)
5. Critical integrations — Third-party APIs your system depends on

What NOT to include

• Edge case validations (negative tests, boundary conditions)
• Complex multi-step workflows (save for integration tests)
• Performance benchmarks (use dedicated load tests)
• Comprehensive schema validation (functional tests cover this)

How to run smoke tests in Flasqo

Flasqo's smoke testing module lets you validate critical endpoints in minutes with zero configuration.

1. Navigate to Smoke Testing
   Go to Testing Types → Smoke Testing → Launch
2. Enter your API base URL
   Example: https://api.yourapp.com
   Flasqo will auto-detect common health endpoints like /health, /status, /ping
3. Add critical endpoints
   Click "+ Add Endpoint" and specify:
   • Endpoint path: /auth/login
   • HTTP method: POST
   • Expected status: 200 or 401 (if auth required)
   • (Optional) Request body for POST/PUT requests
4. Configure authentication (if needed)
   Select auth type:
   • Bearer Token — Paste your API key or JWT
   • API Key — Header or query param
   • Basic Auth — Username/password
   • OAuth 2.0 — Client credentials flow
5. Run smoke tests
   Click "Run Smoke Tests"
   Flasqo executes all endpoints in parallel and reports results in ~30 seconds
6. Review results
   • ✅ Green: Endpoint responded with expected status
   • ❌ Red: Failure (timeout, wrong status, network error)
   • Click any failed test to see request/response details
7. Export or share report
   • Download PDF report for documentation
   • Share public link with your team
   • Integrate with CI/CD using Flasqo's API

Smoke testing in CI/CD pipelines

Automate smoke tests to run on every deployment:

GitHub Actions example

Common smoke testing scenarios

E-commerce API

• GET /health — System is running
• POST /auth/login — Users can authenticate
• GET /products — Product catalog is accessible
• POST /cart/add — Cart functionality works
• POST /checkout — Payment processing is reachable

SaaS application API

• GET /status — API is reachable
• POST /signup — New user registration works
• POST /login — Existing users can sign in
• GET /dashboard — Core UI data loads
• POST /api/create — Primary resource creation works

Payment gateway API

• GET /ping — Service is online
• POST /payments — Payment processing endpoint responds
• POST /refunds — Refund capability is functional
• GET /transactions/:id — Transaction lookup works

Best practices for smoke testing

1. Keep it fast (under 5 minutes)

If smoke tests take longer than your coffee break, you're testing too much. Move comprehensive validations to functional or integration test suites.

2. Test production-like environments

Smoke tests against localhost prove nothing. Use staging or production URLs to validate real infrastructure, DNS, SSL certificates, and network paths.

3. Fail fast and loudly

Don't retry failed smoke tests automatically. A failure means something is critically broken — investigate immediately, don't mask the issue.

4. Monitor smoke test results over time

Track success rates. If smoke tests that previously passed 100% of the time start failing intermittently, it's an early warning sign of infrastructure issues.

5. Run smoke tests post-deployment AND on a schedule

Deployments can succeed but production can still fail minutes later (database connection pool exhaustion, memory leaks, DNS propagation). Scheduled smoke tests catch runtime failures.