keploy.io

Regression testing is the practice of re-running tests against a changed build to confirm that existing behavior still works. You need it whenever code, configuration, or dependencies change — after a bug fix, a refactor, a library upgrade, or an AI-generated patch. The goal is not to prove the change is correct (that's the job of the new test you wrote for it) but to prove the change didn't break something that already worked.

Regression testing vs. retesting, smoke, and integration testing

These terms get used interchangeably, but they answer different questions:

The practical overlap: integration tests are often part of a regression suite, because dependency behavior is exactly what tends to break silently. Retesting is a one-off; regression testing is repeatable and cumulative.

When regression tests should run

The trigger matters more than the size of the suite. Run regression tests when:

• A bug is fixed. The fix can break a neighboring code path that shared the same function, flag, or data shape.
• Code is refactored. Behavior should be identical, which makes regression the only meaningful safety net.
• Dependencies are upgraded. A new database driver, queue client, or third-party API version can change response shapes, timing, or error codes.
• AI-generated or AI-assisted code is merged. Generated changes often look locally correct but alter contracts elsewhere — response fields, status codes, or call ordering.
• Configuration or infrastructure changes. Environment variables, connection pools, and Kubernetes manifests can shift behavior without a single line of application code changing.

Full vs. partial regression, and how to select tests

Running everything on every commit is the safest option and usually the slowest. The three common strategies:

• Full regression — the entire suite. Appropriate before a release, after a large refactor, or when the blast radius is unknown.
• Partial / targeted regression — a subset chosen by impact analysis: which modules the diff touched, which tests cover them, and which downstream consumers depend on them.
• Risk-based selection — prioritize tests covering the highest-traffic or highest-cost paths, then fill in with coverage from the changed areas.

Test selection is where most teams lose time. Two inputs make it tractable: a mapping from code changes to tests (coverage data or ownership metadata), and a record of which tests have historically caught real defects. Tests that have never failed and cover untouched code are the first candidates to defer.

Building a regression suite from real traffic instead of hand-writing cases

Hand-written regression suites drift from reality: they test what someone imagined users do, not what users actually do. An alternative is to capture real requests and the dependency calls they trigger, turn them into replayable tests and mocks, and re-run them against each new build.

Keploy describes exactly this model. Per its documentation, it captures incoming requests and outgoing dependency calls using eBPF and network-level interception, with no application code changes, then converts that captured behavior into editable tests and mocks and replays them against new builds to catch regressions. Its FAQ states the platform generates API tests from traffic, specifications, and application context, and that its record-and-replay approach creates integration and regression tests with virtualized databases, queues, APIs, and other dependencies. It also states tests can run locally or in CI/CD pipelines to detect response, schema, contract, and performance regressions before merge or deploy, and that the core local record-and-replay platform is open source under Apache 2.0, with Kubernetes, staging, and production recording plus governance and dashboards in the enterprise tier.

A concrete task where this helps: you upgrade a payments client library. Instead of guessing which endpoints are affected, you replay recorded checkout traffic — including the calls the service made to the payment provider and the database — against the new build and diff the responses. Schema or contract changes surface as failures without anyone writing a new test case.

Common failure modes and how to triage them

• Flaky tests. A test that passes and fails on unchanged code destroys trust in the whole suite. Quarantine it, capture the failure output, and fix or delete it — a flaky regression test is worse than no test.
• Stale mocks. Recorded dependency responses go out of date when the real dependency changes its contract. Refresh recordings on a schedule or when the upstream version changes, and treat mock drift as a first-class defect.
• Coverage gaps. High line coverage with no tests on the paths users actually hit gives false confidence. Compare coverage against real traffic to find untested-but-used endpoints.
• Over-broad suites. If a full run takes hours, teams stop running it. Split into a fast pre-merge subset and a full pre-release run.
• Silent test deletion. When a regression test fails after an intentional behavior change, the temptation is to delete it. Update the expectation instead, and note why in the commit.

A workable default

Start with a small suite covering your critical paths, run it on every change, and grow it from real traffic and real incidents rather than from a coverage target. Add dependency mocking so the suite runs without a full environment, and keep the pre-merge run short enough that people actually wait for it. Regression testing earns its value through repetition — a suite that runs reliably on every change beats a comprehensive one that runs quarterly.

A free hosted REST API like ReqRes gives you a real HTTP endpoint you can call immediately—no signup, no local server, no database setup. You get predictable JSON responses for users, resources, login, and registration, which makes it useful for front-end demos, integration tests, learning HTTP clients, and prototyping. What it is not is a production backend for your app: the data is shared, resets periodically, and you don't control the schema. If you need persistent, private data with auth and logs, that's where an account-based backend or a commercial licence comes in.

What "free REST API for testing and prototyping" actually means

The phrase sounds vague, so it helps to separate two things people often conflate:

• A mock/sample API — a public, hosted service with fixed or semi-fixed endpoints that return realistic-looking JSON. You don't own the data. It exists so you can point code at a URL and get a response.
• A real backend you configure — a service where you define collections, schemas, authentication, and logging, and where your data persists and belongs to you.

ReqRes's landing page describes both: a free REST API for testing and prototyping with real responses and no signup, plus an option to build your own backend with collections, auth, and logs at app.reqres.in. Those are different products with different trade-offs. The free public endpoints are the "point and go" part; the account-based backend is the "own your data" part.

What you can do with the no-signup public endpoints

1. Front-end demos without a backend

If you're building a UI and need data to render, you can fetch from a public endpoint instead of hardcoding arrays. This keeps your demo code closer to real fetch logic:

async function loadUsers(page = 1) {
  const res = await fetch(`https://reqres.in/api/users?page=${page}`);
  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  const { data, total, page: current } = await res.json();
  return { users: data, total, page: current };
}

You get pagination fields, a data array, and support metadata—enough to build list views, loading states, and empty states.

2. Integration and contract tests

You can assert that your HTTP layer handles status codes, headers, and JSON shapes correctly. Typical checks:

• GET /api/users/2 returns 200 with a data object.
• GET /api/users/23 returns 404 (a non-existent user).
• POST /api/login with valid credentials returns a token; with missing fields returns 400.

This is useful for testing your client wrapper, retry logic, error handling, and serialization—without spinning up your own server.

3. Learning HTTP clients and tooling

If you're new to fetch, Axios, curl, Postman, or HTTPie, a hosted API is a low-friction target. You can practice:

• Sending query parameters (?page=2, ?delay=3).
• Setting headers and reading response headers.
• Handling POST, PUT, PATCH, DELETE.
• Observing status codes for success and failure.

4. Deliberate failure and latency testing

Endpoints that return 404 on purpose, or that accept a delay parameter, let you test how your app behaves when things go wrong or slow down. That's hard to do reliably against a happy-path local mock.

What the public endpoints are not good for

The key limitation: you don't own the data, and other people are hitting the same endpoints. Treat responses as illustrative, not authoritative.

When you'd move to an account-based backend

Consider app.reqres.in (collections, auth, logs) when any of these are true:

• You need your own collections and fields, not the fixed demo schema.
• You need data to persist between sessions and belong only to you.
• You need real authentication flows you can rely on in a demo or internal tool.
• You need request logs to debug what your client actually sent.
• You're working with a team and need shared, stable endpoints.

The trade-off is setup and, eventually, cost. The public endpoints require none; the backend requires an account and configuration.

Where pricing and licensing become relevant

The site signals a commercial licence and an upgrade path (with Stripe as the payment platform), but specific prices, plan tiers, and limits aren't stated here—so don't assume numbers. What you can reason about:

• Prototyping and learning → free public endpoints are usually enough.
• Internal tools, demos for clients, or anything you don't want reset → an account-based backend is the natural next step.
• Production or commercial use → check the licence terms and any paid plan, because "free for testing" and "free for commercial production" are not the same thing.

Before committing, read the current terms on the site rather than relying on secondhand summaries, since pricing and licence scope change.

A quick decision checklist

1. Do you need data that persists and is private? If yes → account-based backend.
2. Do you need a custom schema? If yes → account-based backend.
3. Are you only testing HTTP behavior, UI rendering, or learning a client? If yes → free public endpoints.
4. Will this touch real users or revenue? If yes → review the licence and any paid plan first.
5. Do you need logs and team access? If yes → account-based backend.

If you answer "no" to 1, 2, 4, and 5, the free hosted API is likely all you need. If you answer "yes" to any of them, plan for the account-based path.

Integration testing verifies that separate modules, services, and external dependencies work together correctly — not just that each piece works alone. You need it whenever your code talks to a database, queue, cache, or third-party API, because the bugs that matter most often live in those connections rather than inside a single function. This article covers how integration testing differs from unit and API testing, the main ways to run it (real dependencies, mocks, and record-and-replay), where it fits in CI/CD, and what to check when it breaks.

What integration testing actually verifies

A unit test isolates one function or class and stubs everything around it. An integration test does the opposite: it exercises the boundary where two or more components meet and checks that data and control flow survive the trip.

That boundary can be:

• Internal — module A calls module B inside the same application.
• Service-to-service — your service calls another service over HTTP or gRPC.
• Service-to-dependency — your code reads/writes a database, publishes to a queue, or hits an external API.

The failure modes integration tests catch are the ones unit tests structurally cannot: a schema mismatch, a serialization bug, a wrong SQL column, a queue message that never gets acknowledged, or a contract change in a dependency you don't control.

Integration vs. unit vs. API testing

These layers answer different questions, and you generally want all three.

The overlap is real: API testing is a kind of integration testing when it exercises a real backend and its dependencies. Tools like Postman are commonly used to design and manually test API requests, while integration testing is more concerned with whether the assembled system behaves correctly end to end. As Keploy's FAQ puts it, a platform can support both — generating API tests from traffic and specifications, while its record-and-replay approach creates integration and regression tests with virtualized databases, queues, APIs, and other dependencies.

Three ways to handle dependencies

The core design decision in integration testing is what you do about the database, queue, and external services your code depends on.

1. Real dependencies

Spin up an actual Postgres, Redis, or Kafka instance (often in Docker) and point your tests at it. Highest fidelity, but slow, flaky, and expensive to keep in sync across environments.

2. Mocks and stubs

Replace dependencies with hand-written fakes. Fast and deterministic, but the mock is only as good as your understanding of the real dependency — and it drifts the moment the real thing changes. Tools such as WireMock usually require developers to define and maintain these mocks by hand.

3. Record-and-replay of real traffic

Capture actual requests, responses, and dependency interactions, then replay them against a new build. Keploy does this by capturing incoming requests and outgoing dependency calls using eBPF and network-level interception, without requiring application code changes. It converts the captured behavior into editable tests and mocks, then replays them to catch regressions. This sits between the other two: higher fidelity than hand-written mocks, cheaper than standing up every real dependency.

Where integration tests fit in CI/CD

Integration tests earn their keep when they run automatically before merge. The pattern:

1. Record behavior from a real environment (local, staging, or production) — requests, responses, and dependency calls.
2. Store the resulting tests and mocks as versioned artifacts alongside your code.
3. Replay them in CI against each new build.
4. Fail the pipeline on response, schema, contract, or performance regressions before the code is merged or deployed.

Keploy supports running tests locally or in CI/CD pipelines, and its enterprise capabilities extend recording to Kubernetes, staging, and production environments. The core local record-and-replay platform is open source under the Apache 2.0 license.

This matters more as AI-generated code becomes common: a coding agent can produce a change that compiles and passes unit tests while silently breaking a dependency contract. Replaying recorded behavior against that change is what surfaces the break.

What to check when integration tests break

Most integration failures trace back to the environment, not the code. When a test that passed yesterday fails today, check these in order:

• Environment drift — different database version, missing migration, or a config value that differs between local and CI.
• Stale mocks — the real dependency changed its response shape but your mock still returns the old one (or vice versa).
• Dependency version changes — a library upgrade altered serialization, timeouts, or retry behavior.
• Contract and schema mismatches — a field was renamed, made nullable, or removed on one side of the boundary.
• Test data state — leftover rows, unacknowledged queue messages, or a cache that wasn't cleared between runs.
• Timing and ordering — async operations that the test assumes complete before it asserts.

A useful habit: when a mock and a real dependency disagree, treat the real dependency as the source of truth and regenerate the mock from recorded traffic rather than editing it by hand.

Choosing an approach

There's no single right answer — pick based on what you're protecting against:

• Unit tests for logic inside a single component.
• Hand-written mocks when the dependency is simple, stable, and you need speed.
• Real dependencies when fidelity is critical and you can afford the infrastructure.
• Record-and-replay when you want realistic dependency behavior without maintaining mocks by hand, and you want regression coverage that grows from actual usage.

The practical goal is the same across all of them: catch the interaction bugs that unit tests can't see, and catch them before they reach production.

A postal code API returns structured location data for a given ZIP Code or Canadian postal code. A typical response includes the code itself, city, state or province, county, latitude/longitude, and — where available — ZIP+4 detail. More complete services add time zone, area codes, boundary geometry, and demographic fields. You send a code (or an address), and the API sends back a machine-readable record you can store, validate, or display.

This article explains what those responses contain, how requests are usually shaped, and where postal code data fits into real applications.

First, clear up the word "code"

The keyword "code" is overloaded, and that causes real confusion for developers:

• Postal code — the ZIP Code (U.S.) or postal code (Canada) that identifies a delivery area.
• API key — the credential you use to authenticate your requests. It is not postal data.
• Source code — the program you write to call the API.

When someone searches for "postal code API code," they usually want example request/response code for a postal code service. The rest of this article treats it that way.

What a postal code API actually returns

Response fields vary by provider and endpoint, but the core set is fairly consistent. A single-code lookup commonly returns:

Richer datasets add 90+ fields: boundaries, population, income, elevation, and more. You rarely need all of them — request only what your application uses.

A representative JSON response

{
  "postal_code": "90210",
  "city": "Beverly Hills",
  "state": "CA",
  "county": "Los Angeles",
  "latitude": 34.0901,
  "longitude": -118.4065,
  "timezone": "America/Los_Angeles",
  "area_codes": ["310", "424"]
}

XML responses carry the same information in tag form. Choose based on what your stack parses most easily; JSON is the common default.

Common request patterns

Most postal code APIs support four patterns. Knowing which one you need prevents wasted calls.

1. Lookup by code

You have a code and want its details. This is the simplest and fastest call.

GET /lookup?code=90210

2. Reverse lookup by address

You have a street address and want to confirm or complete the code. This is the pattern behind checkout address validation.

GET /validate?street=...&city=...&state=...

3. Radius search

You have a center point and want all codes within a distance. Useful for store locators and delivery zones.

GET /radius?code=90210&miles=10

4. Batch validation

You have a file of addresses and want them cleaned in bulk. Batch endpoints trade latency for throughput and usually have their own limits.

Handling missing and ambiguous matches

Real data is messy. Plan for these cases:

• No match — the code doesn't exist or the address is malformed. Return a clear error rather than a silent empty object.
• Multiple matches — a city name may map to several codes, or a code may span several acceptable city names. Decide whether to pick the primary or return a list.
• Partial match — the street is valid but the ZIP+4 isn't. Fall back to the 5-digit code.
• Stale data — codes are added, retired, and reassigned. Refresh your dataset on a regular schedule.

A practical rule: validate at the point of entry, store the normalized result, and never re-derive it later from raw user input.

Practical use cases

• Checkout address validation — catch typos before shipping, reduce failed deliveries.
• Shipping zone lookup — map a code to a zone, carrier route, or rate table.
• Data enrichment — append county, coordinates, or demographics to existing records.
• Store and service locators — radius search to find nearby branches or coverage areas.
• Territory and tax logic — county and boundary data drive jurisdiction rules.

Licensing and data-source considerations

Postal code data originates with national authorities — USPS in the United States and Canada Post in Canada. Providers license and repackage it, which is why accuracy, update frequency, and field coverage differ between services. Before committing:

• Confirm the data source and how often it refreshes.
• Check whether ZIP+4 and boundary data are included or sold separately.
• Review usage limits and whether batch processing is allowed.
• Read the license terms for redistribution and storage.

Pricing and plan details change, so check the provider's current documentation rather than relying on secondhand figures.

Getting started

1. Decide which request pattern you need (lookup, reverse, radius, or batch).
2. Pick the fields you'll actually store.
3. Write a small test call and inspect the raw response.
4. Add error handling for no-match and ambiguous cases.
5. Cache results where the same codes repeat.

A postal code API is ultimately a translation layer: you give it a code or an address, and it gives back structured location facts. Understand the fields, match them to your use case, and handle the messy edges — that's most of the work.

Playwright testing means using Microsoft's open-source automation library to drive real browsers — Chromium, Firefox, and WebKit — through scripted user journeys, then asserting on what the page does. It fits best when you need cross-browser end-to-end (E2E) coverage of a web UI and want those checks to run reliably in CI. It is not a backend or dependency-testing tool: if your risk lives in API contracts, database state, or service integrations, Playwright alone won't catch it.

The core idea

A Playwright test opens a browser, navigates your app, interacts with elements, and checks the result. The same test file can run against all three browser engines, which is the main reason teams pick it over single-engine tools.

A minimal test looks like this:

import { test, expect } from '@playwright/test';

test('user can log in', async ({ page }) => {
  await page.goto('https://example.com/login');
  await page.getByLabel('Email').fill('[email protected]');
  await page.getByLabel('Password').fill('secret');
  await page.getByRole('button', { name: 'Sign in' }).click();
  await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible();
});

Input: a running app and a browser. Action: navigate, fill, click. Expected result: the assertion passes or the test fails with a trace you can inspect.

Concepts worth knowing before you write many tests

Locators and auto-waiting

Locators describe how to find an element (getByRole, getByLabel, getByText) rather than a fixed CSS path. Playwright auto-waits for elements to be actionable before interacting, which removes most manual sleep calls. Prefer role- and label-based locators — they survive markup refactors that break brittle selectors.

Fixtures

Fixtures are reusable setup/teardown units injected into tests (a logged-in page, a seeded database, an authenticated API client). They replace copy-pasted beforeEach blocks and make test dependencies explicit.

Parallel execution and isolation

Playwright runs tests in parallel workers by default, each with its own browser context. Contexts are isolated, so tests don't leak cookies or storage into each other — a common source of order-dependent flakiness in other frameworks.

Traces

A trace is a recorded timeline of actions, network calls, DOM snapshots, and console output for a test run. When a CI test fails, the trace is usually the fastest path to the cause.

Playwright vs. Cypress and other approaches

The practical split: Playwright answers "does the UI work in a real browser?" Keploy answers "did the backend and its dependencies change behavior?" They cover different layers, so many teams run both.

Where Playwright sits in a regression strategy

A layered regression suite typically looks like this:

1. Unit tests — fast, isolated logic checks.
2. API / integration tests — contracts, schemas, and dependency interactions.
3. E2E tests (Playwright) — critical user journeys through the real UI.

Playwright should cover the journeys that matter — signup, checkout, permissions — not every screen. Broad UI suites get slow and flaky, and flakiness erodes trust in the whole pipeline.

Keploy's record-and-replay approach targets the layer beneath Playwright: it captures incoming requests and outgoing dependency calls (databases, queues, caches, external APIs) without code changes, converts them into editable tests and mocks, and replays them against new builds to catch response, schema, contract, and performance regressions. That's the class of failure a Playwright test can miss entirely — the UI renders fine while an API silently returns a different shape.

Common failure modes and how to debug them

• Flaky tests. Usually caused by shared state, hard-coded waits, or racing network calls. Fix by isolating contexts, using auto-waiting locators, and asserting on stable conditions instead of timing.
• Timeouts. Often a real bug (element never appears) or an environment problem (app not ready). Check the trace before raising the timeout.
• Selector drift. Role/label locators reduce this; CSS chains amplify it.
• Passing locally, failing in CI. Differences in viewport, locale, or parallelism. Pin these explicitly in config.

The trace viewer is the primary debugging tool: it shows the action sequence, DOM state at each step, and network activity, so you can see why an assertion failed rather than guessing.

Choosing between them

• Pick Playwright when your risk is in the browser UI and you need cross-engine coverage in CI.
• Pick Keploy when your risk is in API behavior, dependency contracts, or regressions that only show up against real traffic.
• Pick both when a change touches UI and backend — Playwright verifies the user sees the right thing; Keploy verifies the services behind it behave the same as before.

Keploy's core local record-and-replay platform is open source under Apache 2.0; enterprise capabilities add Kubernetes/staging/production recording, governance, dashboards, and support. Check the current pricing page for plan details rather than assuming a free tier.