This step asserts that the API response body does not contain a given text string. The check is case-sensitive and searches the raw response body as a string, serializing any parsed JSON object back to a string if needed. It is most useful for confirming that sensitive fields (such as password or secret) are not leaked in a response, or that no error keywords appear in a success response.
The match is a plain substring check - the step fails if the text appears anywhere in the body. All special regex characters in the supplied text are escaped, so you can safely pass values that contain dots, brackets, or other punctuation without unintended wildcard behaviour.
Accepted phrasings
Then the API response should not contain "text"
Then API response should not contain "text"Examples
Then the API response should not contain "error"
Then API response should not contain "unauthorized"
Then the API response should not contain "password"
Then API response should not contain "stack trace"In a real scenario
Scenario: A successful login response does not expose credentials
Given the API base URL is "https://api.example.org/v1"
And I set header "Content-Type" with value "application/json"
When I send a POST request to "/auth/login" with body:
"""
{
"username": "alice",
"password": "s3cr3t"
}
"""
Then the API response code should be 200
And the API response should contain "token"
And the API response should not contain "password"
And the API response should not contain "secret"