Find out who can break your API — before someone does.
Upload the collection you already have. BugVilla generates a complete test suite and runs every endpoint as every role that uses your API — then shows you the exact cell where the wrong person got in.
From an exported collection to provable coverage
Three things you get in the first hour that a request runner will never give you.
Suites you didn't have to write
Seven categories of test cases — functional through performance — built from the schemas, examples and auth already in your collection. Zero assertions written by hand.
Every endpoint, as every role
The access matrix replays each protected endpoint as Admin, Member, Anonymous — and flags the exact cell where a persona reached something it shouldn't.
Versions that never overwrite
Upload v2 and it joins a lineage next to v1, keeping its own endpoints, suites and runs. A contract diff names every breaking change before it bites.
Upload. Impersonate. Report.
The whole cycle runs on the collection you already export today — no agents in your stack, no SDK in your code.
Bring the collection you already have
BugVilla parses every endpoint — method, URL, path and query params, headers, body schema, auth type, examples — then detects your login endpoint, the credential fields, and the token path in the response. You confirm; it never guesses silently.
- Postman Collection v2.1. Folder names become role hints; saved examples become test data.
- OpenAPI 3.x & Swagger 2.0. JSON or YAML — your schemas drive the contract tests.
- Raw cURL. Paste requests straight from a terminal session or a bug report.
The matrix your test runner can't draw
Every protected endpoint, replayed as every persona, asserted allow or deny. The rules are asymmetric on purpose: a deny fails on any 2xx — the persona got in — and on 5xx, because the request reached handler code before the permission check. An allow fails only on 401/403, so bad test data never masquerades as broken permissions.
Why the rules are asymmetric →Reports people read — and machines ingest
PDF and HTML for humans, CSV and JSON for pipelines — all four built from the same data, so a finding can't appear in one and not another. The HTML report is fully self-contained: email it, open it offline, attach it to the incident.
- Exposures vs wrongly blocked. A reached-what-it-shouldn't vulnerability is never filed next to a broken grant.
- Run-to-run diff. Fixed, broken, and still failing — called out between any two runs.
- Trends and latency. Slowest endpoints and a per-persona breakdown, tracked across runs.
Seven categories, generated — not hand-written
Shown in the order they run: functional first so created ids exist for everything after, performance last against a warm service.
Happy path, from your own examples
Happy-path cases built from the parsed method, params and example bodies of each endpoint. Response values — tokens, ids — are captured into run-scoped variables and chained into later requests, so every category after this one has real data to work with.
The response you promised
Every response body validated against the JSON schema in your spec, with AJV. Wrong types, missing fields, and undocumented shapes fail loudly — a docs drift becomes a red test, not a support ticket.
The cross-persona access matrix
Every protected endpoint replayed as every persona, asserting allow or deny. A deny fails on any 2xx — and on 5xx, because the request reached handler code before the permission check ever ran.
Requests that deserve a no
Missing required fields, wrong types, bad auth — generated per endpoint and asserted to fail cleanly, so your API refuses politely instead of stack-tracing.
The inputs nobody types on purpose
Minimum and maximum values, oversized payloads, and fuzz strings pushed through every parsed parameter — the edges of your validation, probed automatically.
Probes before the pentesters arrive
Auth-bypass probes, injection payloads, and response header checks generated for every endpoint — the first pass an attacker would try, run on every single run.
Latency you can hold a baseline to
Per-endpoint latency baselines, measured last in the run against an already-warm service — so a slow number means a slow endpoint, not a cold start.
One project, every surface
Every project is provisioned with all four testing surfaces from day one — API is live now, and the other three sit beside it so the roadmap is always in view.
API Live
The full cycle, today: upload, personas, seven suites, the access matrix, versioned collections, scheduled runs, four report formats.
UI Coming soon
The same persona discipline pointed at your front end — what each role can see and do, not just what it can call.
Application workflow Coming soon
Multi-step business flows tested end to end — the sequences that cross many endpoints and more than one role.
VAPT Coming soon
Vulnerability assessment and penetration testing, run from the same project and reported beside your functional results.
One credential set answers “does it work?” It can never answer “can the wrong person reach it?”
Every BugVilla run signs in as each role exactly once — Admin, Member, Unauthenticated — then asks both questions of every endpoint. Credentials stay isolated per persona; only run-scoped data is shared.
Run your API as everyone who uses it
Upload a collection, confirm your personas, and read your first access matrix today. Free to start — no agents, no SDKs, no changes to your stack.