RESTest

Free plan LinuxSelf-hostedWindows

What RESTest is

RESTest is a free, open-source tool for testing REST APIs using an OpenAPI description rather than the API’s source code. It reads OpenAPI versions 2.0, 3.0, and 3.1, then generates requests with valid or invalid inputs, changes to accepted requests, and short sequences involving created resources. It checks the API’s responses for HTTP 500 errors and bodies that fail to match the documented schema. When RESTest reports a fault, it includes a curl command for repeating the request. It can also produce a machine-readable report.json with faults, operations, operations it could not test, and settings from the run.

Testers can add dictionaries of known values, modify the request campaign plan, and configure options through files, command-line arguments, or environment variables. The command line supports API keys, bearer tokens, and session cookies, with credentials redacted in reports and saved output. RESTest can be used in continuous integration, where its exit codes can fail a build if faults are found. Building requires Java 21 or later and git; running requires a Java runtime. Windows instructions use Git Bash. RESTest is distributed under Apache License 2.0, and version 2.0 cannot use RESTest 1.x files, commands, or reports.

Who it suits

RESTest suits developers and QA teams who have an OpenAPI description and want to check a REST API without access to its implementation. It is also suited to teams that want reproducible fault requests, machine-readable reports, or CI builds that fail when faults are found.

What it does well

Reads OpenAPI versions 2.0, 3.0, and 3.1.
Tests without inspecting the API’s source code.
Fault reports include curl commands for reproducing requests.
Redacts credentials in reports and saved output.
Supports CI build failures when faults are found.
Apache License 2.0; free to use.

What to know first

Building requires Java 21 or later and git.
Windows instructions require running it from Git Bash.
Version 2.0 is incompatible with RESTest 1.x files, commands, and reports.

Limits

Building requires Java 21 or later and git, while running requires a Java runtime. Windows use is documented through Git Bash, and RESTest 2.0 cannot use RESTest 1.x files, commands, or reports.

Plans

Plan	Billed and limits	Price
RESTest	Apache License 2.0 · Java 21 or later and git required	Free

As github.com lists them, read 11 Oct 2026. The maker's own page has the final word.

Getting started

Visit the RESTest GitHub page.
Build with Java 21 or later and git, or use a Java runtime to run it.
On Windows, run RESTest from Git Bash.
Provide an OpenAPI 2.0, 3.0, or 3.1 description and configure the request campaign as needed.
Supply API keys, bearer tokens, or session cookies through the command line when authentication is needed.

Verdict

Choose RESTest if you need OpenAPI-based REST API checks that can run without source access and provide repeatable fault requests. Look elsewhere if you need compatibility with RESTest 1.x files, commands, or reports.

Questions

How much does RESTest cost?

The RESTest plan is free. It is open source under Apache License 2.0.

Which OpenAPI versions does it support?

RESTest reads OpenAPI 2.0, 3.0, and 3.1 documents.

Does RESTest need access to API source code?

No. It tests using the API description and its responses, without inspecting the implementation.

What does it report?

It reports HTTP 500 responses and response bodies that do not match the documented schema. Its machine-readable report.json includes faults, operations, untestable operations, and run settings.

What does it require to run?

Running RESTest requires a Java runtime. Building it requires Java 21 or later and git.

Can RESTest be used on Windows?

Yes. The installation instructions say to run it on Windows from Git Bash.

Facts from RESTest's own pages

Authentication: The --auth option accepts API keys, bearer tokens, and session cookies, and redacts credentials from displayed output and saved reports. · github.com, 11 Oct 2026
CI use: RESTest uses exit code 1 when it finds a fault, allowing build servers to fail a run on nonzero status. · github.com, 11 Oct 2026
Configuration: Users can customize test data with dictionaries, change a campaign plan, and configure settings through files, command-line options, or environment variables. · github.com, 5 Oct 2026
Customization: Users can provide dictionaries of known values and customize request plans and settings. · github.com, 11 Oct 2026
Fault checks: It reports HTTP 500 responses and response bodies that do not match the specification's schema. · github.com, 11 Oct 2026
Fault reproduction: Each reported fault includes a curl command that sends the same request again. · github.com, 11 Oct 2026
Headquarters: Seville, Spain · github.com, 28 Sept 2026
Implementation independent: RESTest does not inspect the API's code, so the API can be written in any language and run anywhere. · github.com, 11 Oct 2026
License: The project is distributed under the Apache License, Version 2.0. · github.com, 11 Oct 2026
No source access required: Testing uses the API description and its responses without inspecting the API's source code. · github.com, 5 Oct 2026
Notable limitation: Operations requiring a file upload are listed as operations RESTest cannot test, with the reason given. · github.com, 11 Oct 2026
OpenAPI support: It reads OpenAPI 2.0, 3.0, and 3.1 specifications. · github.com, 11 Oct 2026
Purpose: RESTest is a black-box testing tool that generates requests from an OpenAPI document, sends them to a REST API, and reports faults. · github.com, 11 Oct 2026
Reporting: RESTest writes a machine-readable report containing faults, operations, and run settings. · github.com, 5 Oct 2026
Reports: RESTest writes a machine-readable report.json containing faults, operations, untestable operations, and run settings. · github.com, 11 Oct 2026
Reproducible requests: Each reported fault includes a curl command to send the same request again. · github.com, 5 Oct 2026
Request strategies: Its generated requests include valid inputs, invalid inputs, mutations of accepted requests, and short sequences involving created resources. · github.com, 11 Oct 2026
Requirement: Building RESTest requires Java 21 or later and git; running it requires a plain Java runtime. · github.com, 11 Oct 2026
Requirements: Building RESTest requires Java 21 or later and git; running it requires a Java runtime. · github.com, 5 Oct 2026
Response checks: RESTest reports HTTP 500 responses and response bodies that do not match the documented schema. · github.com, 5 Oct 2026
Windows support: The installation instructions say to run RESTest on Windows from Git Bash. · github.com, 5 Oct 2026
Windows usage: The README says to run RESTest on Windows from Git Bash. · github.com, 11 Oct 2026

Where RESTest stands on Freedom251

API Testing Tools#21 of 34