API testing for a digital banking app

The client is a UK digital bank whose mobile app sits on top of a growing surface of balance, transfer, and payment APIs. For a bank, a single wrong response on a money-movement endpoint is a customer-trust and regulatory problem, not a minor bug.

Release cadence had accelerated to weekly, but API assurance was still a manual, spreadsheet-driven affair that could not keep pace with the change.

Money-movement endpoints were being tested by hand each release, so coverage was thin and inconsistent, and reviewers had no reliable evidence that a passing check meant a correct response.

Auth flows, error paths, and response contracts were the highest-risk part of the surface, yet they were the least systematically covered. A wrong balance or a leaked field would surface in production, not in review.

The bank needed dependable, repeatable API assurance that ran on every build and produced evidence its auditors could trust, without slowing the weekly release train.

We built a functional, contract, and security suite across the balance, transfer, and payment APIs, asserting status codes, headers, and response schemas on every endpoint so schema drift and breaking changes are caught in CI rather than by a customer.

We exercised the OAuth and JWT flows directly, testing token expiry, scopes, and role-based access, and confirmed that over-scoped or invalid tokens are rejected on every protected route. Rate limits and negative paths were tested as first-class cases, not afterthoughts.

The suite runs headless through Newman in the pipeline, and we layered JMeter load checks over the money-movement endpoints so behaviour under concurrency was verified too. Every failure ships with the exact request, expected versus actual response, and environment, linked in the tracker.