IS 17802 Explained: India's ICT Accessibility Standard and How to Test for It
IS 17802 is India's two-part standard for accessible ICT products and services. This explainer covers what Part 1 and Part 2 contain, how the standard maps to EN 301…
API Testing Services:
REST, GraphQL and gRPC Tests
Vervali tests REST, GraphQL and gRPC APIs and the services behind them: functional and error-path coverage, contract and schema compatibility between provider and consumer, authentication and authorisation, rate limiting, integration with downstream systems, security testing and load testing. Suites run inside your pipeline, in Postman, REST Assured or k6, and report in a form your developers can act on.
150+ clients
450+ projects
275+ engineers
15+ years
ISO/IEC 17025:2017Accredited testing laboratory
CMMI Maturity Level 3The process is written down and repeats
ISO 9001:2015Quality management
ISO/IEC 27001Information security
What We Test in an API
REST, GraphQL and gRPC, covered where integrations actually break: error paths, contracts and access, not only the documented 200.
Functional
Methods, status codes, payloads and the data the caller actually needs. A 200 with the wrong object is a fail, and error paths sit next to the success case.
Contract and Schema
Whether provider and consumer still agree after a change: a field removed, a type widened, a null that used to be required.
Authentication and Authorisation
Tokens, roles and object-level access. A second user who can still read another account is the finding most often missed. Tooling is on API security testing.
Error Handling
What the caller gets when something upstream fails: timeouts, 4xx, 5xx, partial payloads. We write the expected body with your API owner first.
Rate Limits and Quotas
Behaviour at the quota boundary, not below it, with the response a client can act on.
Security and Load
OWASP API Top 10 on agreed in-scope endpoints, and load in k6 from the shape you actually get. We do not claim certified security staff.
Need contract, auth and error-path coverage, not another happy-path collection?
Free API AuditContract Testing Between Teams
A provider ships a change, the consumer build still passes against a mock, and the failure appears in production.
Provider Verifies
The provider checks it still meets the contract each consumer published, before merge.
Consumer Verifies
The consumer checks it still talks to the contract the provider publishes, instead of trusting a stale mock.
Both Owners Take the Red Build
The contract lives in version control next to the service, with an owner on each side. If one side still treats the mock as truth, we say so rather than sell a suite that will not pay back.
Where API Testing Sits Next to the Other API Services
This is the full engagement. These are the layers inside it.
Functional API Testing
One layer of the work: documented behaviour and error paths. See functional API testing.
API Test Automation
How the suite keeps running after every commit. Framework and flake budget are on API test automation.
API Security Testing
The OWASP API Top 10 slice, run on agreed in-scope endpoints. See API security testing.
Building the API itself is on API development.
Already have an endpoint list? A QA lead can scope the pack.
Book a CallTools and Pipeline Integration
Named, because you will scan for them: where the suite is written and where it runs.
Postman and REST Assured
Collections for exploration and a first audit, and REST Assured when the suite has to live in a Java build. Named extras sit in the quote.
k6 for Load
Throughput, latency and error rate at the shape you named, against staging. Platform load is on performance testing.
CI/CD
GitHub Actions, Jenkins or Azure DevOps. Pull requests get the fast contract and smoke set, and nightly gets the wider functional and load pack.
Microservices: Testing a Service You Do Not Own
When the service under test depends on six others, the choices are mocking, a shared environment, or contract testing.
Mocks
Fast, and they lie when the other team changed the payload. Right for early development of a service that does not exist yet.
Shared Environment
Honest and flaky. We use it only for the last integration pass, with test data that does not collide.
Contracts
The one that fails the right build, and it needs both owners. Test data is masked or synthetic, never copied from production. See test data management and compliance.
Case Studies
The API layer of ERP, payment and identity work, described by sector. These were not API-only jobs, but they show Vervali has tested the integrations that move money and records.
India · two leading private-sector banks
Before: loan processing and onboarding depended on integrations behind the screens. After the pack ran: 60% faster loan processing, 50% less agent onboarding time, and 100% compliance on the controls named in that work.
60% faster loan processing 50% less agent onboarding timeIndia · manufacturer · sales-operations platform
Before: the old record and the new process disagreed, and stock was reconciled by hand. Contract and schema checks showed the break before cutover. After: 40% less manual stock reconciliation.
40% less manual stock reconciliationUAE · SME finance platform
Automation on repeatable finance journeys, including the APIs those journeys call. Identity and payment integrations were in that estate and stay unnamed. After: 40% less testing time, and 98% user satisfaction.
40% less testing time 98% user satisfactionHow an Engagement Starts
From one audited service to a suite that fails the right build.
-
01
Share the APIs
Tell us the APIs, their consumers and the endpoint list if it exists. We need staging access under NDA.
-
02
Get the Pack
After that look you receive the coverage model: functional, contract, auth, error, rate-limit, security and load, on the APIs you named.
-
03
Start With One Service
A free API audit of one service shows the surface before anyone writes a quote. Price follows endpoints and roles, and most engagements land at $25 to $49 an hour blended.
-
04
Run It in the Pipeline
Suites run on pull requests and nightly, and the pack is kept current as the APIs change, 9am to 1pm Eastern with delivery from India.
Frequently Asked Questions
It checks that the services behind a product still agree: functional behaviour, contract and schema, authentication and authorisation, error paths, rate limits, security and load. A UI pass does not prove the API, and a consumer that mocks the provider can stay green while production breaks. A free API audit of one service is the first look.
Functional, contract and schema, authentication and authorisation, error handling, rate limits, security and load, across REST, GraphQL and gRPC, run as one engagement against the APIs you name. Each layer is also available on its own: functional API testing, API security testing and API test automation.
Postman for exploration and collections, REST Assured for Java suites, k6 for load, plus schema validation on the contract. Pipelines are GitHub Actions, Jenkins or Azure DevOps, whichever you already run. Any extra tool you want is named in the quote. A free API audit shows which of these already exist.
It is a test that fails the provider or the consumer when they no longer agree, before production. You need it when two teams ship on different clocks and the consumer still mocks the provider. You do not need it when one team owns both sides. Both owners have to take a red build, and we say so in the review.
With real roles, not only a scanner run on the OpenAPI file. We look for tokens that never expire, roles that leak across accounts and objects a second user can still read. Object-level access is the finding automated tools miss. The OWASP slice is on API security testing. We do not claim certified security staff.
Yes, when GraphQL is named in the quote. We test queries, mutations, schema compatibility, authorisation on fields and what the caller gets when a resolver fails. REST and gRPC sit in the same engagement when they are also in scope. A REST collection is not a GraphQL pass, and we do not treat it as one.
Yes. GitHub Actions, Jenkins or Azure DevOps, whichever pipeline you have. Pull requests get the fast contract and smoke set, and nightly gets the wider functional and load pack. A laptop-only run is not the engagement. Reports land in a form developers can act on.
Most engagements land at $25 to $49 an hour blended. Price follows endpoints and roles, whether contract testing is in, whether load is included, and whether the suite is handed over or maintained. A free API audit of one service shows the surface before anyone writes a quote.
Email Us
Call Us
