Correct Use and Best Practices

SmartAPI accelerates API test design, but generated content remains a reviewable draft. Apply these gates before sharing or executing the result.

Use the right workflow

Need	Workflow
Fast generation from a known source	Quick Generation
Separate discovery and design review	API Test Generation
Reuse and version API contracts	File Management
Return to a saved run	API Test Sessions
Execute reviewed generated assets	Transfer to AutoRunner, then run in AutoRunner

Verify provenance

Before any mutation or transfer, record or compare:

• active RabbitQA project;
• managed file and version or cURL origin;
• SmartAPI session ID;
• recognizable endpoint paths;
• service and endpoint counts; and
• the selected template or design prompt.

If staged discovery or session detail shows unrelated reference data, return without editing it.

Protect credentials and data

• Replace authorization headers, cookies, API keys, passwords, and client secrets with variables.
• Use synthetic examples instead of real customer, employee, or company data.
• Inspect uploaded OpenAPI examples, Postman files, HAR files, and cURL commands for hidden secrets.
• Keep runtime secrets in the authorized AutoRunner execution configuration.
• Do not paste confidential data into AI prompts or scripts.

Review generated assets

Check every request method and path against the source contract. Validate bodies, parameters, headers, assertions, captures, and variable ordering. Review positive and negative classifications and remove duplicate or unsafe scenarios.

SmartAPI does not currently provide a complete persisted schema-impact graph, ownership/confidence model, or executed-result traceability inside the generation view. Use the source contract and the AutoRunner report as separate evidence.

Treat destructive actions carefully

• Prefer archive when a session may be needed for history.
• Confirm file-use and version history before deleting a managed source.
• Read replacement warnings before regenerating results.
• Confirm the session ID before permanent deletion.
• Never run generated destructive requests against production without separate authorization and purpose-built safeguards.

Transfer gate

Transfer only after source identity and all generated assets have been reviewed. A Transferred status is not a pass result. In AutoRunner, recheck the imported scenarios, environment, run profile, suite, and final execution report.

Troubleshooting

Problem	What to check
Generate is disabled	Add a valid source or parsed cURL and choose a template or design method.
A managed file is missing	Confirm active project, search term, type filter, and source version.
Discovery shows unrelated paths	Stop; compare session/source identity and do not use reference data as a result.
Immediate and saved counts differ	Use the persisted session ID and session detail as the durable run reference after verification.
Transfer is disabled	Create or select a compatible AutoRunner Postman project.
Imported tests do not run	Configure AutoRunner environment values, secrets, scenario order, run profile, and suite.
Preview is unavailable	Inspect or download the source in its native format; current File Management preview may be pending.