API testing for a video-streaming platform

The client is a US video-streaming platform whose upload, playback, and monetisation APIs sit behind a subscription business serving millions of viewers. When playback fails or a subscription charge misfires, the platform loses revenue and churns customers in the same moment.

The surface mixed REST and GraphQL, and coverage had grown unevenly as features shipped, leaving parts of the monetisation path barely tested.

Endpoint coverage was patchy and undocumented, so no one could say with confidence which parts of the upload, playback, and monetisation surface were actually exercised. Gaps hid in the areas that mattered most commercially.

Auth, rate limiting, and error handling were inconsistently verified across REST and GraphQL, and the negative paths (bad input, expired sessions, throttled clients) were the least covered of all. Those are precisely the paths a real user hits.

The platform needed complete, provable endpoint coverage with auth, limits, and error behaviour validated consistently across both API styles.

We mapped the full endpoint inventory across upload, playback, and monetisation, then built REST and GraphQL suites that assert status codes, response schemas, error shapes, and data-flow behaviour on every one, taking coverage to 100% of the documented surface.

We exercised authentication and session handling directly, confirmed rate limits behave under real request patterns, and made negative cases first-class, so the API is proven to reject bad input and expired sessions cleanly rather than failing open.

GraphQL queries, mutations, and their request-and-response contracts were validated alongside the REST endpoints, and the whole suite runs headless through Newman on every build so regressions surface before release, each with reproducible evidence.