Build an API smoke test

A smoke test proves one critical path works from the caller’s location. It should fail clearly, finish quickly, and avoid mutating production data. Think of it as the question “is it up, really?” asked by a machine: not just “did something answer” but “did the right thing answer with the right content, in time”.

This lesson combines what you’ve built in this module — exit codes, time bounds, and output control — into one script.

The check

Create a small Bash check:

#!/bin/bash
body=$(mktemp)
trap 'rm -f "$body"' EXIT

status=$(curl --silent --show-error --fail-with-body --max-time 10 --output "$body" --write-out '%{response_code}' https://example.org/) || exit 1
test "$status" = 200
grep -q 'Example Domain' "$body"

Each line earns its place. --silent --show-error removes the progress meter but keeps real errors visible. --fail-with-body makes HTTP errors fail the command while still saving the response, so you can read what the server said. --max-time 10 guarantees the check finishes, up or down, within ten seconds. --write-out '%{response_code}' captures the status into a variable while the body lands in a temporary file.

Then two assertions. The status must be exactly 200, not just “not an error”. And the body must contain content we expect — grep -q exits non-zero when the text is missing. That last check catches the failure the status code hides: a load balancer answering 200 with an empty or wrong page.

The trap line removes the temporary file whenever the script exits, on success or failure. Cleanup you don’t have to remember is cleanup that happens.

Prove it fails

A check you’ve never seen fail is a check you can’t trust. Run it with a healthy URL, then break the hostname and expected text:

./smoke.sh; echo "exit: $?"        # exit: 0
# now edit the URL to a wrong hostname
./smoke.sh; echo "exit: $?"        # exit: 1, curl reports the resolution failure
# now change the grep text to 'Wrong Text'
./smoke.sh; echo "exit: $?"        # exit: 1, content assertion failed

Each failure should stop with a non-zero status. That non-zero exit is the contract: cron, CI, and monitoring systems all understand it without parsing any output.

Two boundaries to respect. Use a read-only endpoint, because this script runs often and unattended. And never print a secret-bearing response into shared logs — if the endpoint needs auth, keep the body check minimal and the output quiet.