# Test your API

> Turn captured traffic into security and correctness checks — the Authorization Matrix, which replays every request as each user to find broken access controls, contract checking, which compares live traffic with your OpenAPI spec, and Release Diff, which compares two builds' traffic.

Source: https://docs.subcloak.com/cloak-proxy/testing/overview/

Added in Cloak Proxy 0.4.0.

Cloak Proxy already has the real requests your app makes. This group turns that captured traffic into tests: checks you run against the live server to find bugs that a request you write by hand would never catch, because they only show up with the app's own tokens, IDs and sequences.

  - [Authorization matrix](https://docs.subcloak.com/cloak-proxy/testing/authorization-matrix/): Replay every captured request as another user, an admin, or no credentials, and see where one user gets another's data back (an IDOR).
  - [Contract checking](https://docs.subcloak.com/cloak-proxy/testing/contract-checking/): Check every captured request and response against your OpenAPI spec as the app runs: undocumented endpoints and status codes, missing parameters, and bodies that drift from their schemas.
  - [Release diff](https://docs.subcloak.com/cloak-proxy/testing/release-diff/): Compare two recordings of the same journey: endpoints added and removed, fields that changed type, new errors, slower and extra calls, and new third parties receiving user data.
  - [Make tests from traffic](https://docs.subcloak.com/cloak-proxy/testing/make-tests/): Turn captured requests into a test suite: chained IDs and tokens, and tests inferred from the capture, run in the collection runner or CI.
  - [Compare environments](https://docs.subcloak.com/cloak-proxy/testing/compare-environments/): Send captured requests to staging and production and see which answers differ, or mirror live traffic to a second host.