End-to-end API testing against your real stack.
Kerno writes, runs and maintains tests for every endpoint, catching functional, security and behavior issues before you open a pull request.
Kerno was up and running in minutes with no manual work, and it made our API migration so much smoother. We could instantly validate that every change made by Cursor worked the way we expected, and now it’s a core part of how we build.
Deep code analysis keeps every API test accurate as your codebase changes.
Finds every endpoint your codebase exposes
A compiler-grade index and call graph, so routes your framework generates are found alongside the ones you wrote.
Plans each test from what the endpoint calls
Every dependency, side effect and auth guard on the path is read from the call graph and covered.
Re-tests only what a change actually affects
Kerno maps the blast radius of a change through the call graph and re-runs the endpoints inside it.
Checks the state each request leaves behind
The database rows it wrote, the messages it queued and the downstream services it called, alongside the response.
Gates every run so a failure is a real failure
Pre-flight checks confirm the environment is ready, and every scenario passes an adversarial review before it runs.
Flags every behavior change on the next run
A baseline records how your API behaves today, and the following run reports each field that moved.
Covers behavior, contracts, authorization and edge cases across your backend.
Functional workflows
Endpoint behavior, multi-step sequences, and coordinated service interactions.
Contract & schema
Request and response structures, data types, required fields, and version compatibility.
Authorization
Token validation, role-based access, permission scopes, and session handling.
Error handling
Status codes, error bodies, retries, timeouts, and fallbacks.
Boundary & edge cases
Payload limits, pagination, null and empty values, malformed input, and unexpected types.
Security
OWASP Top 10 on demand, including BOLA, injection, SSRF, and mass assignment.
- TypeScript
- JavaScript
- Python
- Java
- Kotlin
- Go
- Ruby
- PHP
- C#
- Rust
- C
- PostgreSQL
- MySQL
- MariaDB
- MongoDB
- Redis
- Kafka
- RabbitMQ
- AWS
- Azure
- ClickHouse
- Google Cloud
Kerno applies your rules and standards to every test it writes and runs.
Reads your rules and standards in plain English
Write a rule the way you would explain it to a new engineer, and scope it to the repositories and paths it applies to.
Works from the context your team already wrote
Agent instruction files, service READMEs and the docs in your repository shape how every test gets planned.
Gets more accurate with every run you review
Kerno learns from each run and the feedback you give it, and carries what it learns into the tests that follow.
FAQs
Got any extra questions? Reach out on our community channel and we'll be happy to help.
How does Kerno test REST APIs?
Kerno reads your routes and handlers, builds a scenario per endpoint, and runs each against your live services. Every scenario checks the response and the side effects, and the suite replays in CI on every change.
Does Kerno need my OpenAPI spec?
No. Kerno reads your routes and handlers directly from the code, so it works whether or not you maintain an OpenAPI spec.
Can Kerno test authenticated endpoints?
Yes. Kerno mints real credentials and tests token validation, role-based access, and permission scopes across your endpoints.
Does Kerno do black-box or white-box API testing?
Both. With database access Kerno seeds and verifies state directly; over HTTP alone it tests black-box, and it blocks any scenario the environment cannot satisfy up front.
Which languages and frameworks does Kerno support?
Kerno reads every major backend language, from TypeScript and Python to Go, Rust, Ruby, PHP, C#, Java, Kotlin, and Scala, and resolves each framework's own routing on top of that.
Does Kerno run API tests in CI?
Yes. Committed scenarios replay in CI on every pull request, and a behavior change fails the check.