The Contractor Acceptance‑Test Cookbook: 20 Ready‑to‑Paste Playwright & Postman Tests
Written by AppWispr editorial
Return to blogTHE CONTRACTOR ACCEPTANCE‑TEST COOKBOOK: 20 READY‑TO‑PASTE PLAYWRIGHT & POSTMAN TESTS
Ambiguous PRDs produce ambiguous bids. Handing a contractor a list of concrete, runnable acceptance tests solves the single biggest miscommunication founders face: What 'done' actually means. This cookbook gives you 20 copy‑paste tests (Playwright for UI, Postman for APIs + billing/security checks) you can drop into briefs and turn into lightweight pre-merge CI smoke checks.
Section 1
How to use these tests in a contractor brief (one minute checklist)
Treat each test as a single acceptance criterion. In the brief, list the test name, the expected inputs, the exact environment (staging URL, test accounts, and API keys), and whether a failure blocks release. If you give contractors runnable tests instead of vague feature paragraphs, their estimates will reflect implementation complexity rather than interpretation risk.
Include a note about test ownership: who provides test credentials; whether tests run against seeded test data; and which tests the contractor must add to CI. That last bit — requiring tests to be runnable as a CI smoke job — makes ‘definition of done’ verifiable by your engineering team or a reviewer.
- Attach the Playwright spec or Postman collection to the brief.
- Specify staging URL, credentials, and expected HTTP status/URL/DOM selectors.
- Say whether the test must run in CI pre-merge (fast smoke) or post-merge (full suite).
Section 2
20 ready‑to‑paste acceptance tests (grouped by intent)
Below are 20 concise acceptance tests. Each item includes the intended runner (Playwright for UI, Postman for API), what it asserts, and a one‑line 'why this matters' so you can paste it straight into a brief. Use the Playwright examples for UI flows and Postman collection requests for API/billing/security checks.
These are intentionally minimal so they’re easy to adopt as smoke checks. After you paste them, add your environment values (URLs, API keys, test user credentials) and commit the files as part of the contractor deliverable.
- UI: Successful login redirects to /dashboard (Playwright). Why: Validates auth flow & session creation.
- UI: Login error for bad password shows accessible error message with role='alert' (Playwright). Why: Prevents silent failures and ensures screen-reader visibility.
- UI: First‑time onboarding shows step 1 and persists completed flag (Playwright). Why: Ensures feature gating and user state.
- UI: Feature toggle off – hidden CTA not present (Playwright). Why: Validates runtime feature flags.
- UI: Billing page shows correct plan name and price for test account (Playwright). Why: Prevents billing mismatches in UI.
- UI: Upgrade flow creates Stripe checkout session and redirects (Playwright + stubbed backend) — assert 3xx and session id format (Postman or Playwright request). Why: Confirms billing flow starts correctly without charging production accounts explicitly in UI tests when possible via a stubbed call or test mode API key. API: Create user returns 201 with id and role 'user' (Postman). Why: Basic contract for onboarding endpoints. API: Protected endpoint without token returns 401 (Postman). Why: Prevents accidental public access. API: Webhook consumer validates HMAC signature and returns 200 (Postman). Why: Ensures security contract with third parties. API: Billing webhook handles 'invoice.payment_failed' idempotently (Postman). Why: Prevents duplicate actions on retries. Billing: Create subscription with test card returns status 'active' and next_invoice_amount (Postman using Stripe test key). Why: Confirms billing metadata stored and surfaced. Billing: Cancel subscription sets cancelled_at and prorated flag (Postman). Why: Confirms cancellation contract and refunds/credits handling. Security flags: SSO user denied when not in allowed domain (Postman). Why: Prevents unauthorized SSO access. Security flags: Password reset token expires after TTL (Postman). Why: Verifies token TTL enforcement. Integration: Signup -> welcome email queued (assert job enqueued via /admin/jobs or mailtrap API) (Postman). Why: Ensures email side‑effects occur. Integration: Upload file under limit returns 200 and stores object with expected metadata (Playwright for UI upload or Postman if upload endpoint available). Why: Validates file pipeline and size checks. Performance/sanity: Static landing loads within X seconds and main LCP element present (Playwright). Why: Quick guard against gross regressions. Regression: Known bug flow returns expected fixed behavior (copy the exact user steps into a Playwright test). Why: Protects fixes from regressions.
Section 3
Pasteable snippets and practical notes (how to adapt quickly)
Playwright snippet pattern: each test should be self-contained: set up state, perform an action, assert visible DOM and HTTP status if relevant. Use authentication by seeding storage state or using backend login tokens to avoid brittle UI logins. Playwright docs show auth patterns and running tests selectively for quick smoke runs.
Postman pattern: write one request per acceptance criterion, include a small Test script asserting status codes and JSON shape, and keep environment variables for tokens and URLs. Use collection-level pre-request scripts to set auth and shared test-data teardown. Postman docs include test examples and guidance for running collections with Newman or the Postman CLI in CI.
- Playwright: prefer storageState or auth fixtures to speed smoke runs; run single tests with npx playwright test <name>. (See Playwright auth docs.)
- Postman: put assertions in pm.test blocks and reuse environment variables; run collections in CI with Newman or Postman CLI.
- Make a ‘smoke’ subset: pick ~8 highest-risk tests that run under 90 seconds for pre-merge checks.
Section 4
Turning these tests into CI smoke checks (practical pipeline recipe)
Goal: fast, deterministic feedback before merge. Create a pipeline job named smoke or presubmit that checks out the branch, installs minimal deps, runs the smoke subset (Playwright headless, Postman collection via Newman/Postman CLI), and exits non‑zero on failures. Keep smoke jobs fast by stubbing slow external integrations or using sandbox/test-mode keys.
Don’t try to run the entire suite pre-merge. Instead: (1) require the smoke job to pass for PR approval, (2) run the larger suite on main or as a post-merge gate, and (3) use flakiness annotations so flaky tests don’t permanently block shipping. Document which tests run where in the brief so contractors implement them accordingly.
- CI recipe: install deps → run 'npx playwright test smoke' → run 'newman run smoke-collection.json --env-var baseUrl=...' → fail the job on non-zero exit.
- Keep smoke suite under target duration (e.g., 2–3 minutes). If a test requires a slow external step, mock or stub it for the smoke run.
- Record artifacts and concise failure logs to speed contractor debugging (screenshots from Playwright, Newman JSON result).
FAQ
Common follow-up questions
How do I decide which tests belong in the pre‑merge smoke suite?
Pick tests that surface the biggest business risks with the smallest execution time: auth, payment start, critical API paths, and basic UI navigation. Aim for a suite that gives useful feedback within a couple of minutes. Reserve long end‑to‑end flows, flaky network scenarios, and heavy performance tests for post‑merge or nightly runs.
Can contractors write these tests or should my team own them?
Ask contractors to implement and include the tests as part of their deliverables; require tests to be runnable in your CI. That said, your team should review and own the CI integration and failure policies to avoid security or operational surprises.
What if a smoke test flakes in CI and blocks merging?
Triage immediately: mark the test flaky and add a short-term bypass (for example, allow a manual override) while a fix is prioritized. Long-term, invest in stabilizing the test (reduce external dependencies, improve setup/teardown, or replace UI assertions with API checks).
Should I share raw API keys and credentials with contractors?
Never share production credentials. Provide test/sandbox keys with strict scopes and short TTLs. If the contractor needs access to a non-public test environment, create scoped accounts and rotate credentials after the engagement.
Sources
Research used in this article
Each generated article keeps its own linked source list so the underlying reporting is visible and easy to verify.
Microsoft / Playwright
Running and debugging tests | Playwright
https://playwright.dev/docs/running-tests
GitHub / Playwright
playwright-test/docs/auth.md · GitHub
https://github.com/microsoft/playwright-test/blob/master/docs/auth.md
Postman
Postman test script examples | Postman Docs
https://learning.postman.com/docs/tests-and-scripts/write-scripts/test-examples
Postman
Test end-to-end API workflows in Postman
https://learning.postman.com/docs/tests-and-scripts/test-apis/end-to-end-testing
Postman Blog
Postman Playwright Integration: Testing UI and API Together | Postman Blog
https://blog.postman.com/postman-playwright-integration-testing-ui-and-api-together/
Referenced source
Smoke testing (software) — Wikipedia
https://en.wikipedia.org/wiki/Smoke_testing_(software)
Microsoft DevBlogs
Using Postman to Create Acceptance Tests for Customer Engagements - ISE Developer Blog
https://devblogs.microsoft.com/ise/using-postman-for-customer-engagement-acceptance-tests/
Next step
Turn the idea into a build-ready plan.
AppWispr takes the research and packages it into a product brief, mockups, screenshots, and launch copy you can use right away.