Skip to main content
The assertion subject is the left-hand side of every expect statement. It specifies which part of the HTTP response to validate.

status

The HTTP response status code as an integer.

duration

The response time in milliseconds (float). Measured from the start of the request to the end of the response.

Percentile Subjects

For stress testing, percentile subjects represent latency distribution:
For single (non-stress) requests, p50, p95, and p99 all equal the duration value. These subjects are most useful in stress testing mode.

Response header values. Use header <name> to access a specific header.
Header names are case-insensitive as per HTTP specification. For headers, exists means the header is present in the response (even with an empty value) and !exists means it is absent:
Using header without a name returns all headers as an object:

body

The full response body. If the response is JSON, body gives you the parsed JSON value. Otherwise, it returns the raw body as a string. A response counts as JSON when its Content-Type is application/json, text/json or any +json type (application/problem+json, application/vnd.api+json, …), with or without parameters such as ; charset=utf-8. A path into a response that is not JSON (body.x, body[0], jsonpath ...) fails with “response body is not JSON”; it never falls back to the raw text, so body.x exists cannot pass on an HTML error page. The same applies to a JSON Content-Type with an invalid body. With contains, startsWith, endsWith and matches, the whole body of a JSON response is matched as its raw JSON text.

JSON Path Access

Use dot notation to access nested JSON fields:

Array Index Access

Use bracket notation for array indices:

Nested Paths

Combine dot and bracket notation for deep access:

Counts and Queries

Paths use GJSON syntax, so .# counts array elements and .#(...) selects by a condition. The same paths work in captures:
[*] selects the member of every element (items.#.id). A path that matches nothing is absent: exists is false and most operators fail (see null versus absent).

Implicit body Prefix

When the subject doesn’t match a known keyword (status, duration, header, jsonpath, etc.), hitspec treats it as a body path. These are equivalent:

jsonpath

Alternative to body dot-notation using JSONPath-style expressions:
The supported subset is $ (the whole body), .name, ['name'], [0] and [*]. Recursive descent (..), filters ([?(...)]), slices and unions are not supported and fail with an error rather than being guessed at. For queries use the GJSON #(...) form on body.<path>.
For most cases, the body.path syntax is simpler and recommended. Use jsonpath when you need explicit JSONPath semantics.

Quick Reference

Last modified on October 19, 2026