We have a public RESTful web service which exposes functionality to third parties. We are writing automated tests against it. In order to set up all scenarios on it we need to change the data behind it.

We also have a private RESTful web service which exposes functionality to other systems owned by us. However, this web service does not expose endpoints required to set up all the scenarios for the public web service.

In this circumstance is it best to create extra endpoints, not needed in normal operational behaviour, on the private web service in order to support the testing of the public one? Or should we set up our data using other means such as sending SQL commands?

  • 2
    Wouldn't having separate endpoints sort of defeat the purpose of testing? Commented Dec 3, 2013 at 16:18
  • 1
    If it's not possible for your API clients to set up the scenario in a certain way, why are you trying to test that scenario? Commented Dec 3, 2013 at 16:20
  • 1
    @RobertHarvey Do you mean that the new endpoints provide more potential to be incorrect?
    – Polly Shaw
    Commented Dec 3, 2013 at 16:23
  • 3
    The endpoints are not the real endpoints. By definition, you're not testing the system that your users are actually going to use. You can get a partial test this way, but not a comprehensive one. And I get nervous every time someone mentions the use of a "back door." Back doors should only exist in the movie "War Games". Commented Dec 3, 2013 at 16:31
  • 2
    So no, it's not a "best practice." Commented Dec 3, 2013 at 16:33

1 Answer 1


I don't see a need to create back doors for testing.

If you're making use of repo pattern or something similar then test you data access logic separately, and mock your repo in services when testing (I assume you're unit-testing them?). This way you can validate if service calls the correct repo methods with correct inputs.

This was working out pretty well for us.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.