Skip to content
Published on

API Contract Testing & API Tooling 2026 Deep-Dive: Pact, Bruno, Hoppscotch, MSW, Karate DSL, Schemathesis Compared

🇰🇷KO🇺🇸EN🇯🇵JA
Split View필사 모드
Authors

The 2026 API Tooling Landscape: Why Contract Testing Again

Two shifts define the API tooling world in 2026. First, after Postman doubled down on its SaaS-first model in 2023, offline-first open-source alternatives like Bruno and Hoppscotch accelerated into enterprise adoption. Second, OpenAPI 3.1 and AsyncAPI 3.0 stabilized, pushing schema-first workflows back into the mainstream and re-anchoring Pact-style Consumer-Driven Contracts (CDC) as the standard safety net for polyglot microservices. This article compares eleven tools with working code examples.

The Real Problem Contract Tests Solve

Traditional integration tests required both services running together. Past fifty services, CI runs cross an hour and one team's deploy blocks every other team. Contract testing splits the verification: "what the consumer expects" and "what the provider delivers" are tested independently. They meet only through a shared contract file. That is why ThoughtWorks Tech Radar has held Pact in "Adopt" since 2018.

Pact: Why It Became the CDC Standard

Pact began at Realestate.com.au, was open-sourced in 2013, and is now the most mature CDC framework. Clients exist for JS, Java, .NET, Go, Python, Rust, PHP, Swift, and Kotlin, and Pact Broker centralizes contract storage. As of 2026, Pact spec v4 treats messaging (Kafka, RabbitMQ) and GraphQL as first-class citizens.

// consumer-pact.test.js — Jest + @pact-foundation/pact v15
import { PactV4, MatchersV3 } from '@pact-foundation/pact'
import path from 'path'
import { OrderClient } from '../src/order-client.js'

const { like, integer, decimal, iso8601DateTime } = MatchersV3

const provider = new PactV4({
  consumer: 'web-checkout',
  provider: 'order-service',
  dir: path.resolve(process.cwd(), 'pacts'),
  logLevel: 'warn',
})

describe('Order API contract', () => {
  it('returns order details', async () => {
    await provider
      .addInteraction()
      .given('order 42 exists')
      .uponReceiving('a request for order 42')
      .withRequest('GET', '/orders/42', (b) => b.headers({ Accept: 'application/json' }))
      .willRespondWith(200, (b) =>
        b.jsonBody({
          id: integer(42),
          total: decimal(199.99),
          createdAt: iso8601DateTime('2026-05-01T10:00:00Z'),
          items: like([{ sku: 'ABC-1', qty: integer(2) }]),
        })
      )
      .executeTest(async (mockServer) => {
        const client = new OrderClient(mockServer.url)
        const order = await client.fetch(42)
        expect(order.total).toBe(199.99)
      })
  })
})

When the consumer test passes, a pacts/web-checkout-order-service.json file is generated and published to Pact Broker. The provider then replays that contract against its real code using pact-provider-verifier.

Pact Broker and can-i-deploy

Pact Broker is more than a file store. Its killer feature is the can-i-deploy command, which computes the deployability matrix for every consumer/provider version pair across environments. PactFlow is the SaaS, Pact Broker OSS is the self-hosted edition. Toss, a major Korean fintech, runs its own Pact Broker for 50+ microservices and shared the architecture at SLASH 2024.

MSW: Mocking the Browser and Node in One Place

Mock Service Worker uses the Service Worker API in browsers and Node's http interceptors to mock at the network layer. Real fetch/XHR calls are intercepted with no application code changes. Starting with v2 in 2024, the @mswjs/source tool can generate handlers from an OpenAPI spec, and that feature went GA in 2026.

// src/mocks/handlers.js — MSW v2
import { http, HttpResponse, delay } from 'msw'

export const handlers = [
  http.get('https://api.example.com/orders/:id', async ({ params }) => {
    await delay(100)
    if (params.id === '404') {
      return new HttpResponse(null, { status: 404 })
    }
    return HttpResponse.json({
      id: Number(params.id),
      total: 199.99,
      items: [{ sku: 'ABC-1', qty: 2 }],
    })
  }),
  http.post('https://api.example.com/orders', async ({ request }) => {
    const body = await request.json()
    return HttpResponse.json({ id: 99, ...body }, { status: 201 })
  }),
]

MSW vs Pact: Complementary, Not Competing

A common misconception is "if I have MSW, I don't need Pact." They solve different problems. MSW is short-lived consumer-side mocking for development and UI tests. Pact stores the consumer-provider contract permanently and verifies that both sides agree. The ideal combination generates MSW handlers from Pact interactions, a pattern Mercari engineering wrote about publicly in 2024.

Bruno: The Offline-First Postman Alternative

Bruno launched in 2023 and reached enterprise feature parity in v2 (2025). Its biggest differentiator is "collections are files that live in Git." Bruno uses the Bru syntax instead of JSON for clean diffs, and teams can collaborate without cloud sync.

# users/get-by-id.bru — Bruno collection file
meta {
  name: Get user by id
  type: http
  seq: 1
}

get {
  url: {{baseUrl}}/users/{{userId}}
  body: none
  auth: bearer
}

auth:bearer {
  token: {{accessToken}}
}

vars:pre-request {
  userId: 42
}

assert {
  res.status: eq 200
  res.body.id: eq 42
  res.body.email: matches /.+@.+\..+/
}

tests {
  test("user has expected role", function() {
    expect(res.getBody().role).to.equal("admin")
  })
}

Hoppscotch: A Browser-Native Open-Source API Workbench

Hoppscotch, formerly Postwoman, is a PWA-based full-stack API client. REST, GraphQL, WebSocket, SSE, MQTT, and Socket.IO all live in a single UI. Since 2024, Hoppscotch Cloud and a self-hosted Enterprise Edition have been separate offerings, with GDPR-sensitive teams preferring self-host. SmartHR in Japan has shared that it standardized on Hoppscotch for internal GraphQL schema exploration.

Karate DSL: BDD-Style API Tests Without Java Code

Karate, built by Intuit, is a Java-based API testing framework, but users never write Java. Gherkin syntax covers REST, GraphQL, performance testing (Karate Gatling), and UI testing (Karate UI). The 2026 v1.5 release added official GraalVM Native Image support, cutting CI startup by roughly 80%.

Feature: Order API contract

Background:
  * url 'https://api.example.com'
  * header Accept = 'application/json'

Scenario: get order returns expected schema
  Given path 'orders', 42
  When method get
  Then status 200
  And match response ==
    """
    {
      id: 42,
      total: '#number',
      createdAt: '#regex .+T.+Z',
      items: '#[] #object'
    }
    """

Scenario: create order
  Given path 'orders'
  And request { sku: 'ABC-1', qty: 2 }
  When method post
  Then status 201
  And match response.id == '#number'

Schemathesis: Property-Based Testing Derived From OpenAPI

Schemathesis is a Python tool built on top of Hypothesis. Given an OpenAPI/Swagger or GraphQL schema, it auto-generates thousands of edge cases and verifies invariants such as "no valid input should produce a 5xx" and "every response must match the schema."

# Schemathesis CLI basic usage
pip install schemathesis

schemathesis run \
  --checks all \
  --workers 8 \
  --hypothesis-deadline 1000 \
  --report \
  https://api.example.com/openapi.json

# In CI, target a single endpoint fast
schemathesis run \
  --include-path-regex '^/orders' \
  --max-examples 50 \
  --base-url https://staging.example.com \
  ./openapi.yaml

Schemathesis adopters include GitLab, Spotify, and Bose. In Korea, Kakao Enterprise rolled it out for internal API gateway regression in 2024.

Dredd: Markdown- and OpenAPI-Driven Testing

Dredd, built by Apiary, is one of the oldest OpenAPI testing tools still in use. It reads API Blueprint or OpenAPI 2.0/3.0 documents and calls every example against the live API. Simple, but very effective at enforcing "the docs are not lying." Active development has slowed in 2026, but the tool is considered stable.

Prism: Stoplight's OpenAPI Mock Server

Prism instantly converts OpenAPI 3.x documents into an HTTP mock server. Front-end teams can hit realistic responses before the backend exists. prism mock openapi.yaml is enough to start, and both example-based and dynamic modes are supported. Combining Schemathesis with Prism gives you regression testing of the OpenAPI spec itself, with no backend required.

RestAssured: The De Facto Standard in Java

RestAssured is a Java/Groovy integration testing library that integrates naturally with JUnit 5 and TestNG. Combined with Spring Boot Test, WireMock, and TestContainers, it lets a single test file describe entire microservice integration scenarios. Where Karate is BDD-style, RestAssured is code-first.

Postman and Insomnia: The Current SaaS Generation

Postman v11 in 2024 added Postman AI, deepening its SaaS-only stance. Insomnia, owned by Kong, faced a 2024 license backlash that birthed the Insomnium fork. Both are powerful, but collections being tied to cloud and limited self-host policies have driven finance and public-sector teams toward Bruno and Hoppscotch.

OpenAPI 3.1: What Actually Changed

OpenAPI 3.1 is now 100% aligned with JSON Schema 2020-12. The largest break is that nullable was removed in favor of canonical JSON Schema type: ["string", "null"] arrays. A new webhooks object also makes inbound callback APIs first-class.

openapi: 3.1.0
info:
  title: Order Service
  version: 2.0.0
paths:
  /orders/{id}:
    get:
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: integer
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Order'
webhooks:
  orderShipped:
    post:
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ShippedEvent'
      responses:
        '200':
          description: Webhook received
components:
  schemas:
    Order:
      type: object
      required: [id, total]
      properties:
        id:
          type: integer
        total:
          type: number
        cancelReason:
          type: ['string', 'null']

AsyncAPI 3.0: The OpenAPI of Event-Driven APIs

AsyncAPI 3.0 went GA in December 2023, extending the same schema-first philosophy to Kafka, RabbitMQ, MQTT, WebSocket, and AMQP. The breakthrough in 3.0 is the separation of channels and operations, so a single channel can describe send and receive directions cleanly. Microcks and EventCatalog provide AsyncAPI-driven mock brokers and catalogs.

GraphQL Schema Testing

GraphQL is closer to "schema is the contract" than REST, so contract testing feels natural. But "response matches the schema" and "the query meets BFF business needs" are different things. Apollo GraphOS schema-check, GraphQL Inspector, and the Pact GraphQL plugin each address a different layer of that problem.

CDC vs Integration Tests vs Schema Validation

These three are constantly confused. Schema validation (Dredd, Schemathesis, Prism) checks "the spec is internally consistent and responses match it." Contract testing (Pact) checks "the provider does not break what consumers actually depend on." Integration testing checks "two real services together pass an end-to-end scenario." CDC can replace 99% of integration tests but never 100%.

CI Integration Pattern: Pact + GitHub Actions

name: api-contract
on: [push, pull_request]
jobs:
  consumer-contract:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm run test:pact
      - name: Publish pacts
        if: github.ref == 'refs/heads/main'
        env:
          PACT_BROKER_BASE_URL: https://broker.example.com
          PACT_BROKER_TOKEN: $PACT_TOKEN
        run: npx pact-broker publish ./pacts --consumer-app-version=$GITHUB_SHA --branch=main
      - name: Can I deploy
        run: npx pact-broker can-i-deploy --pacticipant web-checkout --version $GITHUB_SHA --to-environment production

A Tool Selection Matrix

ToolCategoryOpen SourceRESTGraphQLMessagingStrength
PactCDCYesYesYesYesTwo-sided contracts, Broker
MSWMockingYesYesYesNoBrowser + Node parity
BrunoClientYesYesYesWSGit-friendly
HoppscotchClientYesYesYesWS/MQTT/SSEPWA, multi-protocol
KarateE2EYesYesYesKafkaBDD DSL
SchemathesisFuzzingYesYesYesNoProperty-based generation
DreddSpec checkYesYesNoNoSimplicity
PrismMock serverYesYesNoNoInstant from OpenAPI
RestAssuredCode testsYesYesYesNoJUnit integration
PostmanSaaS clientNoYesYesWS/gRPCLargest ecosystem
InsomniaSaaS clientPartialYesYesgRPCClean UI

KR/JP Case Studies: Toss, Kakao, Mercari, Cybozu

Toss standardized Pact + Pact Broker across 50+ microservices and pipes can-i-deploy output into a Slack bot (SLASH 2024). Kakao Enterprise adopted Schemathesis for Kakao Work API regression. Mercari combined Pact Message and Karate Kafka for message-queue contract testing. Cybozu migrated the kintone public API documentation to OpenAPI 3.1 and hosts a Prism mock server for external developers.

Anti-Patterns: What Not to Do

First, do not turn Pact into an integration test by booting both services together; that defeats the purpose. Second, an OpenAPI spec that has drifted from code makes every contract test a lie. Use type-first tooling (tRPC, Zod, openapi-fetch) to keep code and spec in sync. Third, never run Schemathesis against production. Always hit staging or an isolated environment.

A Recommended Polyglot Stack

A realistic 2026 default: MSW for front-end development and UI tests, Pact + Pact Broker for consumer-provider contracts, Schemathesis for OpenAPI regression, Prism when the backend does not yet exist, Bruno (Git-friendly) or Hoppscotch (PWA) for day-to-day API exploration, Karate or RestAssured for E2E. Reserve Postman for external partner demos only.

A Migration Checklist

Postman to Bruno: use Bruno CLI import postman-collection to convert collections. Environment variables move into the vars block of bru files. WireMock to MSW: there is no automated 1:1 stub-to-handler converter yet, so plan a manual port. Dredd to Schemathesis: start with --checks all to grow beyond simple example validation into property-based coverage. OpenAPI 3.0 to 3.1: rewrite nullable: true as type: ["string","null"]. The openapi-format tool automates that conversion.

Conclusion: Treat Contracts Like Code

The essence of API contract testing is "the spec changes with the code and is verified with the code." The 2026 tooling landscape is mature enough. What is usually missing is not a tool but a team-level agreement: what consumers expect, what providers guarantee, and who records the boundary between them. Pact or Schemathesis simply record that agreement durably.

References

Discuss on Twitter • View on GitHub