Back to API Practice

Security/Auth trainer

Password Policy API Practice

Practice password rule validation, breached password checks, Unicode and whitespace boundaries, policy migrations, safe errors, and accessibility.

Start writing test ideasTry API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

  1. 1Choose a preset case
  2. 2Send a simulated request
  3. 3Read the response and QA note
  4. 4Write what you would test
  5. 5Check your coverage

Interactive sandbox

Try the API request

Pick a preset, send a simulated POST /api/auth/password-policy/validate request, inspect the fake response, and turn it into test ideas.

Passwords are fake local examples only and are never sent anywhere.

Request

Build the request

POST/api/auth/password-policy/validate

Request JSON

application/json
{
  "password": "CorrectHorseBatteryStaple!42",
  "flow": "signup",
  "locale": "en"
}

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

Validation

Security

Boundaries

Reliability

Response

Fake API result

Send a simulated request to see status, response JSON, QA note, and what to notice. No real backend is called.

List valid, too short, too long, weak/common, breached, Unicode, whitespace, confirmation mismatch, localized errors, rate limits, provider outage, safe logs, and policy consistency.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance
API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

Password Policy endpoint

Validate password policy consistently across signup, password reset, and change-password flows.

Endpoint

POST/api/auth/password-policy/validate

Purpose

Validate password policy consistently across signup, password reset, and change-password flows.

Request fields

  • password: string, required
  • flow: signup | reset | change
  • locale: optional language code
  • confirmation: optional client-side helper

Success response

200 OK

Request body

{
  "password": "CorrectHorseBatteryStaple!42",
  "flow": "signup",
  "locale": "en"
}

Example response body

{
  "valid": true,
  "requirements": ["minLength", "notBreached"]
}

Errors

  • 400 validation error
  • 413 password too long
  • 422 weak or breached password
  • 429 rate limited
  • 503 breach provider unavailable

Security notes

  • Password is never returned
  • Password is never logged
  • Policy errors avoid account enumeration
  • External breach checks handle outage safely

Business rules

  • Same policy applies across auth flows unless configured
  • Messages are localizable and accessible
  • Policy migrations do not strand existing users
  • Metrics exclude password values