A passing Karate suite only proves the scenarios you wrote still pass. It says nothing about OpenAPI operations that were never called. That gap grows when specs add endpoints, deprecate fields, or rename routes faster than feature files are updated.
A direct check is to diff exercised calls against the spec instead of trusting the green run. A small script is often enough for small services.
- List every path + method pair from your OpenAPI document as the expected set.
- Collect the actual set by parsing Karate feature files for url, path, and method, or by logging requests during a run.
- Join the two sets to find untested operations, then prioritize by auth scope and breaking-change risk.
Generate stubs only for the missing operations, with one happy path and one auth or validation failure each. Keep the coverage diff in version control so the next spec change shows which operations lost coverage.
For larger specs, the harder part is keeping that mapping stable across refactors, parameterized paths, and versioned routes without hand-maintaining aliases.
How do you currently detect OpenAPI endpoints your Karate suite never exercises?
Top comments (0)