This step asserts that a named property is absent from the JSON response. Property paths use dot notation, so user.password checks for a password key nested inside a user object. The step fails if the property exists with any value, including null or false. It passes only when the property resolves to undefined - meaning the key is genuinely not present.
This is particularly useful for security-oriented checks: confirming that a public endpoint does not return internal fields such as password, token, apiKey, or debug information. Combine it with should not contain text for a belt-and-braces approach when sensitive data must never appear in a response.
Accepted phrasings
Then the JSON response should not have property "name"
Then the API response should not contain property "name"
Then the JSON response should not have property "parent.child"
Then the API response should not contain property "parent.child"
Examples
Then the JSON response should not have property "password"
Then the API response should not contain property "secret"
Then the JSON response should not have property "user.password"
Then the API response should not contain property "debug"
In a real scenario
Scenario: A public profile endpoint does not expose sensitive fields
Given the API base URL is "https://api.example.org/v1"
And I set header "Accept" with value "application/json"
When I send a GET request to "/users/5/profile"
Then the API response code should be 200
And the response should be valid JSON
And the JSON response should have property "displayName"
And the JSON response should not have property "password"
And the JSON response should not have property "apiKey"
And the API response should not contain property "internal"