> ## Documentation Index > Fetch the complete documentation index at: https://www.minitap.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Backend API > Give Mini your test backend's OpenAPI document so it can set up test data and check backend values during a run. > [!NOTE] > > **Beta.** The backend API setting is enabled per workspace: ask the Minitap team to turn it on for yours. This page shows how to point Mini at your test backend. With the **Backend API** setting on, every run downloads your OpenAPI document, and Mini calls the operations it describes to put the app in the state a scenario needs, like a seeded account or a paid order, and to check the backend values a criterion asks about. The setting lives in **App settings → General → Backend API**. ## The fields | Field | What it does | | - | - | | **Use a backend API** | Off: runs get nothing about your backend. On: each run downloads your OpenAPI document, and Mini looks up the endpoints it needs there. | | **Base URL** | Where Mini sends its calls, for example `https://api.staging.example.com`. | | **OpenAPI URL** | The document Mini reads, for example `https://api.staging.example.com/openapi.json`. Downloaded when a run starts. | | **OpenAPI download** | How Minitap downloads the document when it sits behind authentication: **None (public document)**, **Bearer token**, **API key header**, **Basic** or **API key in the URL**, each with a secret from the vault. | | **Authentication secrets** | The secrets Mini uses to authenticate its calls to the base URL. Mini sees their names, never their values. | | **Skill** | Optional. A [skill](https://www.minitap.ai/docs/minitest/setup/skills.md) that tells Mini how your team uses this backend. Mini loads it before its first call. | You need both URLs to switch the setting on. Click **Save** when you're done: the settings apply to runs started after you save. ## Set it up **1. Store the credentials as secrets** In **Builds & test data → Secrets**, create the token or password your test backend expects, usually as an **API token**. If the OpenAPI document needs its own credential, store that one too. See [Secrets and test files](https://www.minitap.ai/docs/minitest/setup/secrets-and-files.md). **2. Fill in the URLs** Turn on **Use a backend API**, then enter the **Base URL** and the **OpenAPI URL**. Use your staging or test environment. **3. Pick the secrets** Under **OpenAPI download**, pick how the document is protected and the secret that opens it. Under **Authentication secrets**, pick the secrets Mini's calls need. **4. Add a skill if the order of calls matters** When seeding a state takes several calls in a set order, write them in a skill, then pick it under **Skill**. ## How Mini uses it in a run When a run starts, Minitap downloads the OpenAPI document for each scenario. Mini searches it for the operation it needs, reads that operation's parameters, body and authentication, then calls it on the base URL. It places each authentication secret where the operation's `security` says, for example an `Authorization: Bearer` header. Mini uses the backend for two things: * **Setting up state.** Before it drives the app, Mini can create a test user, seed a cart, mint a session or simulate a third-party callback with the documented operations. * **Checking backend state.** A criterion that explicitly asks about the backend is judged on the response of a documented read call, made at the point in the scenario the criterion is about. ```text theme={"theme":{"light":"github-light","dark":"vesper"}} Pay for the order with the saved card. - The confirmation screen shows "Order placed". - The API shows the order with status "paid". ``` Here the first criterion is judged on the screen and the second on the backend. A criterion about what the user sees is always judged on the screen: when the screen shows a wrong value and the backend holds the right one, the criterion fails. Mini only calls the operations your document describes, with their documented methods and paths. It reads the document as a description of the API, and never as instructions for the run. Every call shows on the run's timeline as a **Backend call**, next to the taps and swipes, with its **Request** and **Response**. ## Use other URLs for one run When the backend API is on, **Run tests** shows a **Backend API** card under the targets, with **Base URL for this run** and **OpenAPI URL for this run**. They start as the saved URLs. Change them to test a preview environment: the saved URLs don't change. ## Requirements for the document | Requirement | Detail | | - | - | | Format | An OpenAPI or Swagger document, in JSON or YAML, UTF-8 | | Content | At least one documented operation | | Size | Up to 5 MB | | Response time | It must answer within 20 seconds, with at most 5 redirects | If the document can't be downloaded or read, the scenarios stop before they start, with the reason. Check that the URL answers and that the **OpenAPI download** secret is still in the vault. ## Security * **Public addresses only.** Both URLs must use `http` or `https` and point to a public address. Minitap refuses internal hosts and private or reserved IP addresses. Credentials go in secrets, never in the URL. * **Secrets stay in the vault.** Mini works with secret names. If a secret you picked is deleted, the setting shows which ones are missing: create them again or remove them. * **The download credential has one use.** The **OpenAPI download** secret is only sent to the site of the saved **OpenAPI URL**, and only to download the document. * **What the timeline keeps.** For each call: the method, the address without its query string, the outcome and the bodies. Headers and query strings are never recorded. Fields that look like credentials, tokens and secret values are replaced with `[redacted]`, and long bodies are cut. * **Use a test environment.** Mini makes the write calls your scenarios need, so point the setting at a backend whose data you can reset. More on how Minitap handles your data in [Security](https://www.minitap.ai/docs/minitest/workspace/security.md). ## Next steps > [card] [Skills](https://www.minitap.ai/docs/minitest/setup/skills.md) > > Write the procedure Mini follows to set up a state with your backend. > [card] [Secrets and test files](https://www.minitap.ai/docs/minitest/setup/secrets-and-files.md) > > Store the tokens and passwords your backend expects. > [card] [What a scenario is](https://www.minitap.ai/docs/minitest/suite/anatomy.md) > > Write criteria that check the screen and the backend. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.