Test API Errors and Edge Cases Before Production

Interfaces fail at boundaries: sessions expire, records disappear, lists are empty, requests slow down, and services become unavailable. A controlled local backend makes these states reproducible before a shared test environment is ready.

Use a fixed seed and record counts to start from predictable data. Reset or regenerate through the local control API, then use CRUD requests to establish the exact state a test needs.

Test valid, missing, incorrect, expired, and revoked credentials with bearer, API-key, or Basic modes. Verify redirects, reauthentication, protected-route handling, and safe error messages.

Global failure injection produces probabilistic HTTP 503 responses. Real runtime behavior also produces 400 for invalid queries, 401 or a configured unauthorized status, 404 for missing resources, and 409 when deleting a referenced parent. Arbitrary route-specific 403, 422, 429, or 500 scenarios are not currently configurable.

Set a fixed response delay to inspect spinners, skeletons, disabled controls, timeouts, duplicate submissions, and navigation while a request is pending. Change the latency through the runtime control API between scenarios.

Use a zero or small record set for empty states, request the last and beyond-last pages, test the maximum allowed limit, search for absent values, and submit a sort field outside the allowlist.

A local mock does not validate production security, database constraints, deployment configuration, real network infrastructure, backend performance, or third-party integrations. Keep contract, integration, security, load, and end-to-end tests against appropriate real environments.

Start with the screens that have the highest state complexity. Document the seed, runtime controls, credentials, and requests for each scenario so another tester can reproduce it.