Then the JSON response should not have property "propertyPath"

This step asserts that a named property is absent from the JSON response. Property paths use dot notation, so user.password checks for a password key nested inside a user object. The step fails if the property exists with any value, including null or false. It passes only when the property resolves to undefined - meaning the key is genuinely not present.

This is particularly useful for security-oriented checks: confirming that a public endpoint does not return internal fields such as password, token, apiKey, or debug information. Combine it with should not contain text for a belt-and-braces approach when sensitive data must never appear in a response.

Accepted phrasings

Then the JSON response should not have property "name"
Then the API response should not contain property "name"
Then the JSON response should not have property "parent.child"
Then the API response should not contain property "parent.child"

Examples

Then the JSON response should not have property "password"
Then the API response should not contain property "secret"
Then the JSON response should not have property "user.password"
Then the API response should not contain property "debug"

In a real scenario

Scenario: A public profile endpoint does not expose sensitive fields
  Given the API base URL is "https://api.example.org/v1"
  And I set header "Accept" with value "application/json"
  When I send a GET request to "/users/5/profile"
  Then the API response code should be 200
  And the response should be valid JSON
  And the JSON response should have property "displayName"
  And the JSON response should not have property "password"
  And the JSON response should not have property "apiKey"
  And the API response should not contain property "internal"

Related steps

Back to Api Steps