API testing for an IoT device platform

The client is a German industrial IoT platform whose device, telemetry, and notification APIs are consumed by fleets of connected equipment and downstream operational systems. On a factory floor, a dropped telemetry event or a malformed notification is not cosmetic: it can mask a fault or delay a response.

The platform spanned REST and WebSocket interfaces, and a change to one had a habit of silently breaking a consumer of the other.

Endpoints passed in isolation but broke in the real data flow, where a device event triggers telemetry ingestion which in turn drives notifications. Testing each interface alone missed exactly the failures that mattered.

Real-time delivery over WebSocket was largely unverified, so ordering, reconnection, and payload consistency under live conditions were unknowns. Producer changes could break downstream consumers without anyone noticing until the field reported it.

The platform needed integration and contract testing that followed data across the whole surface and guaranteed a release could not silently break a connected consumer.

We built contract tests that pin every event and response to its expected schema, so a producer change that alters a payload fails the pipeline instead of reaching a device. Schema contracts turned a fragile web of interfaces into a stable, evolvable surface.

We tested the real data flow end to end, chaining device registration, telemetry ingestion, and notification delivery, and validated the WebSocket streams for ordering, reconnection, and consistency under live traffic rather than in isolation.

The suite runs headless through Newman on every build, exercising REST and WebSocket paths together, so state and side effects across dependent services are checked as one journey. Failures land with the exact request, stream, and environment attached.