DocumentationFramework guide

REST Assured test evidence

REST Assured supplies API assertions while JUnit 5 and Maven Surefire produce the portable result files. Retain those reports on the same CI/CD run and QaCockpit can normalize the test evidence.

01

Use Maven Surefire JUnit reports

A standard Maven test run creates one XML report per test class undertarget/surefire-reports. No QaCockpit library is required in the API test project.

Run and result path
mvn --batch-mode test

# Surefire writes JUnit-style reports here by default:
target/surefire-reports/TEST-*.xml

The default directory is usually enough. Configure it explicitly when a multi-module build, shared parent POM, or existing plugin setup writes results elsewhere.

pom.xml — optional explicit report location
<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-surefire-plugin</artifactId>
  <configuration>
    <reportsDirectory>${project.build.directory}/surefire-reports</reportsDirectory>
    <redirectTestOutputToFile>true</redirectTestOutputToFile>
  </configuration>
</plugin>

02

Retain every XML file in CI/CD

Keep the whole Surefire report set. A single wildcard that misses a module or a publish step skipped after mvn test fails can make the imported scope incomplete.

GitHub Actions

Upload Surefire evidence

Retain TEST-*.xml and safe text diagnostics with if: always().

Copy GitHub steps →
Azure DevOps

Publish the report directory

Use PublishPipelineArtifact@1 with condition: always().

Copy Azure steps →

03

Capture useful API diagnostics safely

A failure message should identify the assertion and safe request context without leaking authentication material. Preserve request and response diagnostics only after redacting tokens, cookies, personal data, and sensitive payload fields.

  • Keep the expected and actual HTTP status or contract difference in the failure message.
  • Attach sanitized request and response bodies only when they materially help diagnosis.
  • Never print Authorization headers, API keys, session cookies, or secret variables.
  • Use deterministic test names and parameter labels so history and Test Scope remain stable.

04

Inspect a complete public example

The public repository runs against an in-process HTTP fixture. It demonstrates parameterized and skipped results, a controlled failed API test, and a reduced-scope scenario without calling a production or customer service.