Load test REST, GraphQL, and SOAP APIs.
Record real client traffic, replay at scale. ASM auto-correlates OAuth2 Bearer tokens, JWT, API keys, and CSRF rotation. Datasets parameterize thousands of virtual users from a CSV or a sequence generator. Run from your own AWS account up to 1 million concurrent users.
Any HTTP is fair game.
WPLoadTester captures whatever HTTP your API client emits. The protocol layered on top is your business. If the client can call it, the recorder records it and the load engine replays it.
- REST · JSON and XML bodies, path parameters, query strings, custom headers
- GraphQL · queries and mutations over HTTP
- SOAP / WSDL · envelope bodies, SOAPAction headers, multipart attachments
- gRPC-Web · protobuf bodies over HTTP/2 or HTTP/1.1
- Microservice chains · multi-step flows where one service’s response feeds the next request
The captured request and response bodies are editable in the visual editor. Tweak a payload, change a header, point a request at staging vs production — no rerecording required.
Auth tokens auto-correlate.
Modern APIs return fresh tokens on every interesting request. OAuth2 Bearer in the response, expected in the next Authorization header. JWT from the login endpoint, expected on every protected route. X-CSRF-Token rotated on every state-changing call. Manually tracking these across a recorded session is the most common reason API load tests fail to replay.
ASM detects the canonical patterns up-front and configures the correlation rules automatically. The AI Assistant catches the long tail by watching replays for runtime errors, identifying the auth-token shape, and generating the detection rule on the spot. From a real engagement: an OAuth login flow that previously took 2 hours of manual correlation typically configures in around 4 minutes.
Datasets for parameterization.
One recorded request becomes a load test of thousands of distinct API calls. Point WPLoadTester at a CSV, a database query, or a sequence generator, and every virtual user gets its own row of values substituted into request bodies, query strings, path parameters, and headers.
- CSV / TSV / fixed-width files
- Database queries (JDBC for SQL Server, Oracle, MySQL, Postgres, others)
- Sequence generators: ranges, randoms, dates, UUIDs, per-VU counters
- Inline value lists for small data sets
- Per-VU vs shared-across-VUs binding modes
1M virtual users from your AWS account.
API-only load tests typically pack denser than browser-based tests, since each virtual user does not have to fetch HTML, parse CSS, or render images. WPLoadTester 7 Cloud distributes load across EC2 instances in your own AWS account, scaling to 1 million concurrent virtual users when needed. EC2 bills directly to your AWS account; no per-VU-hour pricing.
Try an API load test on your service.
The recorder, ASM, datasets, and Cloud execution ship in WPLoadTester 7. Request the beta to run a 1M-VU API test against your service, or download the free single-machine edition to evaluate locally.
Reference: the canonical API testing docs live at docs.webperformance.com.