NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
PyPI · #2283 most downloaded on PyPI
Adaptive API testing for OpenAPI and GraphQL
Last release today
04 Oct 2026
Ships fairly regularly
a new release about every 1 weeks
Nearly every release is documented
notes for 60 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
7 years old
490 releases · first in 2019
Path parameters with unsupported regex patterns now use sample values instead of failing generation during the coverage phase.
Automatic API Operation Dependency Detection: Schemathesis now automatically discovers dependencies between operations (e.g., POST /users -> GET /user
POST /users -> GET /users/{userId}), enabling stateful testing without manual configuration. Currently detects path parameter dependencies; query / body parameter support coming in next release.One column per quarter.
False positive error about recursive references when there are non-recursive and non-removable ones present in the same schema.
False positive schema error message due to incorrect schema type detection. #3149
Properly generate boundary values for negative maximum during the coverage phase.
maximum during the coverage phase.examples in Open API 2.0 responses.negative_data_rejection check for an array of strings query parameters. #3056negative_data_rejection check for application/x-www-form-urlencoded media type.--mode=negative.type values.Generating empty path parameters during the coverage phase leads to false negative response schema conformance failures.
Incorrectly generated cURL command for empty headers.
False positives in ignored_auth check if auth is declared as optional. #3052
ignored_auth check if auth is declared as optional. #3052False positives in use_after_free check when validation errors occur before resource existence checks.
use_after_free check when validation errors occur before resource existence checks.apply_to and skip_for filters in map_case, filter_case, flatmap_case, and before_generate_case hooks.:rocket: Schemathesis 4.1 is out :rocket:
:rocket: Schemathesis 4.1 is out :rocket:
The main addition: Automatic Link Inference for Stateful Testing
Schemathesis now generates OpenAPI links by analyzing Location headers from API responses.
How it works:
Location headers during earlier test phases (e.g., POST /users → Location: /users/123)userId from Location)POST /users → GET /users/{id} → PUT /users/{id})This is a basic inference mechanism - more sophisticated heuristics for discovering operation relationships will be added in future releases.
Other notable changes:
--max-redirects CLI & config file option. #712enabled config file option to disable all test phases. #2951codec for header generation.Content-Type header is unknown.before_call hooks now accept kwargs as a regular parameter instead of **kwargs. There is a backward compatibility shim for existing hooks with **kwargs signatures. The old calling convention will be removed in Schemathesis 5.0. #3028Location headers from API responses. #2953--max-redirects CLI & config file option. #712enabled config file option to disable all test phases. #2951codec for header generation.Content-Type header is unknown.before_call hooks now accept kwargs as a regular parameter instead of **kwargs. There is a backward compatibility shim for existing hooks with **kwargs signatures. The old calling convention will be removed in Schemathesis 5.0. #3028Support the const, additionalItems, dependencies, if, then, else, patternProperties, propertyNames, contains, keywords in top-level parameter schemas.
const, additionalItems, dependencies, if, then, else, patternProperties, propertyNames, contains, keywords in top-level parameter schemas.not keyword and false JSON Schemas.API accepted schema-violating request caused by passing security-related header via CLI during the stateful phase.workers = "auto" being incorrectly rejected in configuration files. #3015
workers = "auto" being incorrectly rejected in configuration files. #3015workers values.Examples:
These improvements come from removing unnecessary memory allocations in unnecessary pretty-printing operations in Hypothesis.
Internal error on incorrect value for --tls-verify when the schema URL is accessed via HTTPs. #3007
--tls-verify when the schema URL is accessed via HTTPs. #3007False positives in ensure_resource_availability check by limiting it to 404 responses only.
ensure_resource_availability check by limiting it to 404 responses only.Parameter overrides replace all explicit examples instead of merging with them. #3000
Disable Hypothesis-level deadline for all Schemathesis tests.
Internal error in the ignored_auth check in ASGI/WSGI integration.
ignored_auth check in ASGI/WSGI integration.AttributeError during response conformance checks if the response schema contains an error in the properties definition.
AttributeError during response conformance checks if the response schema contains an error in the properties definition.Correctly merge quantifiers into regular expressions with anchors and a single literal.
required with a boolean value instead of an array.Generating negative test cases incorrectly marked as invalid if anyOf or oneOf are present. #2975
Internal error if the stateful phase is used with --generation-unique-inputs. #2977
--generation-unique-inputs. #2977Incorrect serialization of parameters with nested structures during the coverage phase. #2966
multipleOf during the coverage phase.Negative test cases with invalid parameters mistakenly become positive test cases. #2900, #2913
--config-file CLI option.Honor filters defined via a config file in pytest integration.
pytest integration.Display cURL code samples for application-level exceptions when using the ASGI / WSGI integration.
Check for wildcard response keys when searching for response definitions. #2960
Negative test cases with invalid query parameters mistakenly becoming positive test cases.
x-examples as a list for Open API 2.0.Do not generate negative test cases during the coverage phase if the original schema accepts any value.
Use utf-8 encoding when generating JUnit reports.
utf-8 encoding when generating JUnit reports.negative_data_rejection and positive_data_acceptance checks. #2900Support for application/yaml media type.
application/yaml media type.application/yaml media type.Use utf-8 encoding when generating JUnit reports
utf-8 encoding when generating JUnit reportsutf-8 encoding when generating JUnit reportsImprove error messages for negative_data_rejection and positive_data_acceptance checks.
negative_data_rejection and positive_data_acceptance checks.Show cURL commands on network timeouts.
Pytest: Cleaner error reporting for Schema-related errors (like unknown media type).
tls-verify, request-timeout, request-cert, and request-cert-key options supplied via the config file.Don't send explicitly passed headers for the missing_required_header check. #2898
missing_required_header check. #2898Config file validation for operations that don't include any configuration options.
operations that don't include any configuration options.--include-* & --exclude-*. #2894Schemathesis 4.0 is a major rewrite of the core engine, Python API, and pytest integration. This release includes extensive breaking changes - see the…
Schemathesis 4.0 is a major rewrite of the core engine, Python API, and pytest integration. This release includes extensive breaking changes - see the migration guide for upgrading from v3.x.
Configuration system:
Added schemathesis.toml with operation-specific settings, environment variable substitution, and multi-project support:
headers = { Authorization = "Bearer ${API_TOKEN}" }
[[operations]]
include-name = "GET /users"
request-timeout = 5.0
generation.max-examples = 200
Improved testing:
Updated CLI:
--max-examples, --mode, etc.)--report junit,vcr,har)Complete documentation rewrite available at https://schemathesis.readthedocs.io/en/stable/ with new guides, tutorials, and API reference.
This is a major release with extensive breaking changes affecting the Python API, CLI options, and supported versions:
This release only includes documentation & URLs updates.
Check the Migration Guide for key changes.
Greetings, dear reader! I am happy to announce the first beta release of Schemathesis 4.0. This major version includes significant improvements to the
🎉 Schemathesis v4.0.0 Beta 1🎉
Greetings, dear reader! I am happy to announce the first beta release of Schemathesis 4.0. This major version includes significant improvements to the core engine, Python API, and pytest integration.
I encourage everyone to try the beta and share your feedback! For upgrading from v3, please see the migration guide for key changes and removed features.
requests / httpx / werkzeug responses in Case.validate_response. #1718unsupported_method and missing_required_header checks.Case.formatted_path.ignored_auth. #2779requests / httpx / werkzeug responses in validate_response and is_response_valid.is_response_valid to is_valid_response for consistency with other functions in the codebase.query / path_parameters / headers / cookies to an empty dict instead of None.Case.__slots__.headers from config file.basic_auth from config file.ignored_auth when it is passed to call or call_and_validate. #2846ignored_auth.parameters in the error message about missing HTTP method.Schema.add_link. Adjust your API schema manually instead.Schema.configure. Use the config file instead. If you used to pass app to Schema.configure, pass it to Case.call or Case.call_and_validate instead.@schema.override. Use the parameters configuration option instead.Change this:
@schema.override(path_parameters={"user_id": 42})
To:
parameters = { user_id = 42 }
This release features rewritten documentation, now live at https://schemathesis.github.io/schemathesis/
This release features rewritten documentation, now live at https://schemathesis.github.io/schemathesis/
What's included:
Coming in the next release:
This should be the final alpha release. Going forward, I'll focus on documentation improvements, feature polish, and providing a migration guide for the stable release.
not_a_server_error check. #2539@schemathesis.serializer decorator as a way to serialize data of media types not supported by Schemathesis.operation returned only 4xx responses during unit tests warning if the API operation only returned HTTP 500 responses.ignored_auth in negative testing mode.ChunkedEncodingError.Accept) are now correctly omitted during negative testing for missing required headers.phases.coverage.generate-duplicate-query-parameters config option allows for controlling this behavior.schemathesis.target -> schemathesis.metric, TargetContext -> MetricContext--contrib-openapi-fill-missing-examples. Use [phases.examples] configuration table instead:[phases.coverage]
fill-missing = true
INTERNAL: Ignore deprecation warnings from jsonschema.
Introducing schemathesis.toml as a configuration file for Schemathesis.
It provides fine-grained control over individual API operations and supports multi-project configurations. Global settings go at the top level, with dedicated sections for operations and projects.
CLI options override configuration file settings when specified.
Example:
# Default settings for any project
base-url = "https://api.example.com"
# Settings specific to `GET /users`
[[operations]]
include-name = "GET /users"
request-timeout = 5.0
# Specific to Payments API matched by `info.title`
[[project]]
title = "Payment Processing API"
base-url = "https://payments.example.com"
workers = 4
You can also use environment variable substitution for string values:
headers = { Authorization = "Bearer ${API_TOKEN}" }
positive_data_acceptance and missing_required_header checks.maxItems & unsupported pattern combination.positive_data_acceptance.pattern & maxLength combinations.positive_data_acceptance on 5xx responses.>6.131.14.openapi.json and similar filenames. #2757jsonschema.--experimental CLI option. All experimental features have been stabilized.--experimental-coverage-unexpected-methods CLI option. Use [phases.coverage] configuration table instead:[phases.coverage]
unexpected-methods = ["PATCH"]
--experimental-missing-required-header-allowed-statuses CLI option. Use [checks.missing_required_header] configuration table instead:[checks.missing_required_header]
expected-statuses = [200, 201, 202]
--experimental-positive-data-acceptance-allowed-statuses CLI option. Use [checks.positive_data_acceptance] configuration table instead:[checks.positive_data_acceptance]
expected-statuses = [200, 201, 202]
--experimental-negative-data-rejection-allowed-statuses CLI option. Use [checks.negative_data_rejection] configuration table instead:[checks.negative_data_rejection]
expected-statuses = [200, 201, 202]
--set-{header,cookie,path,query} CLI options. Use parameter overrides in the configuration file instead:# Global parameters
[parameters]
api_version = "v2"
# Operation-specific parameters
[[operations]]
include-name = "GET /users/"
parameters = { limit = 50, offset = 0 }
[[operations]]
include-name = "GET /users/{user_id}/"
# Disambiguate parameters with the same name
parameters = { "path.user_id" = 42, "query.user_id" = 100 }
Generate negative test cases for large nested arrays during the coverage phase.
Support basic canonicalisation of regex patterns. For example, [\\W\\w] could be replaced with . in some scenarios.
[\\W\\w] could be replaced with . in some scenarios.multipart payloads. #2776enum values during the coverage phase.patterns during the coverage phase."type": "object" is not present.items during the coverage phase.Additional base_url validation for BaseSchema.configure method.
base_url validation for BaseSchema.configure method.SCHEMATHESIS_DISABLE_COVERAGE environment variable so the coverage phase can be disabled for the pytest integration.str in enums.pattern keywords in response schema validation. #2749schemathesis.pytest.from_fixture.minItems & maxItems during the coverage phase.default value as valid input during the coverage phase.multipart/form-data fields not added to the final test case payload.type: string enums during the coverage phase.HookContext & BaseSchema as a part of the public Python API.--experimental-coverage-unspecified-methods CLI option that accepts a comma-separated list of HTTP methods to use when generating test cases with meth
--experimental-coverage-unspecified-methods CLI option that accepts a comma-separated list of HTTP methods to use when generating test cases with methods not specified in the API during the coverage phase.Incorrect quantifiers merging for patterns involving single-element sets of characters like [+].
[+].This release introduces a new phase management system for CLI that simplifies test execution control and separates unit testing into different stages.
This release introduces a new phase management system for CLI that simplifies test execution control and separates unit testing into different stages.
Phase configuration changes:
examples (formerly explicit): Runs examples specified in the API schemafuzzing (formerly generate): Testing with randomly generated test casescoverage: Deterministic testing of schema constraints and boundary valuesreuse and shrink remain enabled by default. Disable via --generation-database=none and --no-shrink.target phase available via --generation-maximize=<METRIC>NOTE: Pytest integration does not currently have a way to disable the coverage phase. Python API support is planned for future releases.
coverage and examples into independent testing phases.--hypothesis-phases with --phases.unsupported_method failure if the API returned HTTP 200 on the OPTIONS request.--experimental-no-failfast option has been stabilized as --continue-on-failure.
This option ensures all test cases within a scenario are executed, even if failures occur.1 errors instead of 1 error in CLI output.--hypothesis-no-phases.--exitfirst. Use --max-failures=1 instead.--report unified reporting system with multiple format support.
--report unified reporting system with multiple format support.--report-dir for centralized report storage.--generation-optimize to --generation-maximize--generation-mode to -m/--mode--generation-max-examples to -n/--max-examples--junit-xml to --report=junit--cassette-* options to --report=vcr/har with format-specific paths optionsshrink in --hypothesis-phases with a separate --no-shrink optionUNRESOLVABLE sentinel instead of an empty string when Open API runtime expressions can't be evaluated (e.g., when $response.body#/id is not found)validate_response method in state machines now accepts the same keyword arguments as call.
If you've overridden this method, update its signature to include **kwargs.verify=False properly when specified via get_call_kwargs on a state machine. #2713--cassette-format (replaced by --report).Add LoadingStarted & LoadingFinished to the public API.
LoadingStarted & LoadingFinished to the public API.type.PYTHONIOENCODING environment variable that is not utf8.ensure_resource_availability check.Improved visibility into Open API link extraction success/failure status #823
--include-* and --exclude-* CLI options.Here is how it looks:
This is an alpha release - expect breaking changes and missing features. If you're using Schemathesis in production, stick with 3.x for now. The docum…
I'm releasing Schemathesis 4.0.0a1 - the biggest change in the project's history. I've rewritten major parts of the core engine, Python API, and pytest integration from scratch to enable features that were impossible to implement before. While this means removing some functionality temporarily, it was necessary to clean up four years of accumulated hacks and create a more solid foundation.
This is an alpha release - expect breaking changes and missing features. If you're using Schemathesis in production, stick with 3.x for now. The documentation is outdated, and I'll update it as the new architecture stabilizes.
I'd really appreciate your feedback at this GitHub Discussion - it will help shape the path to stable 4.0. A detailed migration guide and complete changelog will follow.
--phases CLI option to control unit & stateful testing.schemathesis.from_uri → schemathesis.openapi.from_urlschemathesis.from_pytest_fixture → schemathesis.pytest.from_fixtureResponse class instead of requests.Response.schemathesis.sanitization.configure instead of Config instance.--data-generation-methods → --generation-mode--targets → --generation-optimize--hypothesis-derandomize → --generation-deterministic--hypothesis-database → --generation-database--hypothesis-seed → --generation-seed--contrib-unique-data → --generation-unique-inputs--hypothesis-max-examples → --generation-max-examples--sanitize-output → --output-sanitize--hypothesis-suppress-health-check → --suppress-health-checkaiohttp integration.
Old-style stateful runner (new one is now default).
Schemathesis.io integration & --report option (local HTML reports coming later).
FastAPI fixups.
Python code samples (only cURL now).
Python 3.8 support.
Support for pytest<7.0.
CLI Options: --endpoint, --method, --tag, --operation-id, --skip-deprecated-operations,
--show-trace, --debug-output-file, --hypothesis-deadline, --hypothesis-report-multiple-bugs,
--hypothesis-verbosity, --store-network-log, --pre-run, --dry-run, --contrib-openapi-formats-uuid,
--validate-schema.
Most loader configuration moved to schema.configure method.
add_case hook.
schemathesis.contrib.unique_data.
Single argument AuthProvider.get.
schemathesis.runner.prepare (use schemathesis.engine.from_schema).
schemathesis replay command.
Stateful testing summary (coming later).
SCHEMA_ANALYSIS experimental feature.
Missing reference resolution scope when serializing multipart payloads. #2776
multipart payloads. #2776Do not mutate pattern keywords in response schema validation. #2749
pattern keywords in response schema validation. #2749minItems & maxItems during the coverage phase.default value as valid input during the coverage phase.BaseSchema and HookContext as a part of the public Python API. #2777multipart/form-data fields not added to the final test case payload.type: string enums during the coverage phase.Internal error in the coverage phase due to incorrect example value extraction.
### :wrench: Documentation - Fix documentation build.
--experimental-coverage-unexpected-methods CLI option that accepts a comma separated list of HTTP methods to use when generating test cases with metho
--experimental-coverage-unexpected-methods CLI option that accepts a comma separated list of HTTP methods to use when generating test cases with methods not specified in the API during the coverage phase.[+].Deduplicate failures from negative_data_rejection by response status code. It makes Schemathesis display more different failures for this check.
negative_data_rejection by response status code.
It makes Schemathesis display more different failures for this check.unsupported_method failure if the API returned HTTP 200 on the OPTIONS request.Warning for operations that return only 4xx responses during unit tests to help identify potential base URL or data generation issues.
negative_data_rejection check.Internal error in the coverage phase when a parameter is mixing keywords for different types.
verify=False when specified via get_call_kwargs on a state machine. #2713Handling of complex regex patterns with multiple quantifiers to respect length constraints during test generation.
type.Rebuild Docker stable with the v3 branch.
stable with the v3 branch.Your coding agent can read these notes before it upgrades. Set up the MCP server →