rest-assured/rest-assured

Testing and validation of REST services in Java is harder than in dynamic languages such as Ruby and Groovy. REST Assured brings the simplicity of using these languages into the Java domain.

• 2026-10-23: REST Assured 6.3.0 is released. It prepares for REST Assured 7.0.0, which drops Apache HttpClient 4 and Groovy from the default dependencies. Every API that 7.0.0 removes now has a replacement, the old ones are deprecated, and the new rest-assured-openrewrite module has a recipe that moves your code over. Among the replacements are timeouts as Duration in HttpClientConfig, SSLContext support in SSLConfig and followRedirectsForAllMethods(..) in RedirectConfig. Form authentication now also uses the config and proxy of your request for all its requests. See Preparing for REST Assured 7.0, the release notes and the change log for more details.
• 2026-10-16: REST Assured 6.2.0 is released. The rest-assured module is now written entirely in Java and no longer depends on Groovy directly. Tests that run in parallel no longer fail because of races in the static configuration, and auth().certificate(..) now sends the client certificate to servers that ask for one (mutual TLS). Many failures that used to show up as Groovy exceptions or a NullPointerException now give a clear error message, and scala-support is upgraded to a Scala version that fixes CVE-2022-36944. This release contains several non-backward compatible changes, so please read the release notes before upgrading. See also the change log for more details.
• 2026-10-09: REST Assured 6.1.0 is released. It adds support for the HTTP QUERY method, JSON Schema draft-06, draft-07, 2019-09 and 2020-12, and java.time values as parameters. Authorization and Cookie headers are no longer sent along when a redirect goes to a different host. There are also many bug fixes, several of them from the community. See release notes and change log for more details.

Older News

Here's an example of how to make a GET request and validate the JSON or XML response:

get("/lotto").then().assertThat().body("lotto.lottoId", equalTo(5));

Get and verify all winner ids:

get("/lotto").then().assertThat().body("lotto.winners.winnerId", hasItems(23, 54));

Using parameters:

given().
    param("key1", "value1").
    param("key2", "value2").
when().
    post("/somewhere").
then().
    body(containsString("OK"));

Using X-Path (XML only):

given().
    params("firstName", "John", "lastName", "Doe").
when().
    post("/greetMe").
then().
    body(hasXPath("/greeting/firstName[text()='John']")).

Need authentication? REST Assured provides several authentication mechanisms:

given().auth().basic(username, password).when().get("/secured").then().statusCode(200);

Getting and parsing a response body:

// Example with JsonPath
String json = get("/lotto").asString();
List<String> winnerIds = from(json).get("lotto.winners.winnerId");
    
// Example with XmlPath
String xml = post("/shopping").andReturn().body().asString();
Node category = from(xml).get("shopping.category[0]");

REST Assured supports any HTTP method but has explicit support for POST, GET, PUT, DELETE, OPTIONS, PATCH and HEAD and includes specifying and validating e.g. parameters, headers, cookies and body easily.

• Getting started
• Usage Guide (click here for legacy documentation)
• Javadoc
• Rest Assured Javadoc
• Rest AssuredMockMvc Javadoc
• XmlPath Javadoc
• JsonPath Javadoc
• Release Notes
• FAQ

Join the mailing list at our Google group.

• Change log
• REST Assured on openhub
• Mailing list for questions and support