{
"type": "email",
"seed": 42,
"count": 3,
"items": [
{
"value": "user@[192.168.1.1]",
"category": "ip_literal_domain",
"breaks": "Domain-parsing code that assumes the part after '@' is always a hostname (never a bracketed IP literal) fails to extract or validate the domain correctly.",
"safe_to_display": true
},
{
"value": "[email protected]",
"category": "punycode_domain",
"breaks": "The domain is punycode-encoded (an internationalized domain name). Domain allowlist or comparison logic that does not decode punycode may fail to recognize this as equivalent to its Unicode form, or fail to catch a homograph-spoofed lookalike domain encoded the same way.",
"safe_to_display": true
},
{
"value": "[email protected]",
"category": "plus_addressing",
"breaks": "Deduplication logic treating '[email protected]' and '[email protected]' as different accounts misses that most mail providers deliver both to the same inbox (sub-addressing, RFC 5233).",
"safe_to_display": true
}
]
}
curl --location --request GET 'https://zylalabs.com/api/13372/unicode+internationalization+test+data+generator+api/28541/generate+edge+case+test+data?type=email&count=3&seed=42' --header 'Authorization: Bearer YOUR_API_KEY'
{
"seed": 7,
"count": 2,
"rows": [
{
"user_email": {
"value": "a234567890123456789012345678901234567890123456789012345678901234@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.com",
"category": "max_length_254",
"breaks": "This address is near the RFC 5321 maximum length of 254 characters. Database columns sized below that maximum truncate or reject it even though it is technically valid.",
"safe_to_display": true
},
"signup_at": {
"value": "2026-11-01T01:30:00-04:00",
"category": "dst_fall_back_ambiguous",
"breaks": "In US Eastern time, this local clock time occurs twice during the fall-back transition. Without an explicit fold indicator, converting it to UTC is genuinely ambiguous, and libraries may silently pick the wrong occurrence.",
"safe_to_display": true
}
},
{
"user_email": {
"value": "[email protected]",
"category": "plus_addressing",
"breaks": "Deduplication logic treating '[email protected]' and '[email protected]' as different accounts misses that most mail providers deliver both to the same inbox (sub-addressing, RFC 5233).",
"safe_to_display": true
},
"signup_at": {
"value": "2026-01-01T24:00:00",
"category": "midnight_as_24_00",
"breaks": "ISO 8601 permits 24:00:00 to represent midnight at the end of a day, but many parsers only accept 00:00:00 through 23:59:59 and reject this equally valid representation.",
"safe_to_display": true
}
}
]
}
curl --location --request POST 'https://zylalabs.com/api/13372/unicode+internationalization+test+data+generator+api/28542/generate+multi-field+test+fixture+rows' --header 'Authorization: Bearer YOUR_API_KEY'
--data-raw '{
"fields": {
"user_email": "email",
"signup_at": "datetime"
},
"count": 2,
"seed": 7
}'
{
"types": [
{
"type": "date",
"category_group": "datetimes",
"description": "Calendar-boundary and invalid-looking-but-real dates.",
"categories": [
"earliest_iso_year",
"far_future_sentinel",
"invalid_day_of_month",
"leap_day",
"pre_epoch",
"year_2038"
],
"entry_count": 6
},
{
"type": "datetime",
"category_group": "datetimes",
"description": "Timestamps at DST transitions, unusual UTC offsets, and precision boundaries.",
"categories": [
"dst_fall_back_ambiguous",
"dst_spring_forward_gap",
"leap_second",
"midnight_as_24_00",
"quarter_hour_offset",
"sub_microsecond_precision"
],
"entry_count": 7
},
{
"type": "email",
"category_group": "emails",
"description": "RFC 5322-valid but unusual email addresses.",
"categories": [
"comment_syntax",
"ip_literal_domain",
"max_length_254",
"mixed_case",
"plus_addressing",
"punycode_domain",
"quoted_local_part"
],
"entry_count": 7
},
{
"type": "email_display_name",
"category_group": "emails",
"description": "Display-name strings that can corrupt naively-built SMTP headers.",
"categories": [
"angle_bracket_in_display_name",
"comma_in_display_name",
"crlf_header_injection",
"null_byte",
"very_long_display_name"
],
"entry_count": 5
},
{
"type": "emoji_sequence",
"category_group": "unicode",
"description": "Multi-codepoint emoji: ZWJ sequences, skin-tone modifiers, flag sequences, keycaps.",
"categories": [
"flag_sequence",
"keycap_sequence",
"skin_tone_modifier",
"zwj_family",
"zwj_generic_pair"
],
"entry_count": 5
},
{
"type": "float",
"category_group": "numbers",
"description": "Floating-point values that are not representable in JSON, or that expose IEEE 754 rounding.",
"categories": [
"denormal_minimum",
"ieee754_rounding",
"infinity",
"not_a_number",
"scientific_notation"
],
"entry_count": 5
},
{
"type": "integer",
"category_group": "numbers",
"description": "Integer values at 32-bit and 64-bit signed boundaries.",
"categories": [
"int32_max_plus_one",
"int32_min_minus_one",
"int64_max",
"leading_zeros",
"negative_zero"
],
"entry_count": 5
},
{
"type": "json_key",
"category_group": "structural",
"description": "Strings intended for use as a JSON object key, including reserved and unsafe names.",
"categories": [
"dollar_prefix",
"embedded_dot",
"empty_string_key",
"numeric_string_key",
"prototype_pollution_key",
"very_long_key",
"whitespace_only_key"
],
"entry_count": 8
},
{
"type": "json_value",
"category_group": "structural",
"description": "JSON values at precision, nesting, and null/empty/missing boundaries.",
"categories": [
"boolean_as_string",
"empty_array",
"empty_object",
"explicit_null",
"float64_precision_loss",
"leading_zero_numeric_string"
],
"entry_count": 6
},
{
"type": "organization_name",
"category_group": "names",
"description": "Company/brand names with punctuation, leading digits, or unusual casing.",
"categories": [
"accented_character",
"ampersand",
"apostrophe",
"intentional_lowercase_brand",
"leading_digit",
"trailing_punctuation",
"very_long_legal_name"
],
"entry_count": 7
},
{
"type": "path_or_filename",
"category_group": "identifiers",
"description": "Filenames and paths that are legal but mishandled by common filesystem or validation code.",
"categories": [
"bare_parent_reference",
"leading_dot_hidden_file",
"max_length_255",
"path_traversal",
"reserved_windows_device_name",
"trailing_dot",
"trailing_space",
"unicode_normalization_mismatch"
],
"entry_count": 8
},
{
"type": "person_name",
"category_group": "names",
"description": "Names that break naive validation, splitting, or templating logic -- includes canonical injection probes.",
"categories": [
"apostrophe",
"emoji_in_name",
"leading_trailing_whitespace",
"mononym",
"multi_word_particle_surname",
"reserved_word",
"right_to_left_script",
"shell_metacharacter_probe",
"single_character",
"sql_injection_probe",
"ssti_probe",
"very_long_name",
"xss_probe"
],
"entry_count": 14
},
{
"type": "phone_number",
"category_group": "addresses_phones",
"description": "Phone numbers at E.164 length boundaries and common formatting variants.",
"categories": [
"e164_maximum_length",
"e164_near_minimum_length",
"extension_suffix",
"human_formatted_punctuation",
"leading_zero_national_format",
"long_country_code"
],
"entry_count": 6
},
{
"type": "postal_code",
"category_group": "addresses_phones",
"description": "Postal codes from formats that break US-centric assumptions.",
"categories": [
"canada_alternating_pattern",
"country_without_postal_code",
"eircode",
"embedded_hyphen",
"leading_zero_us_zip",
"uk_postcode_variable_length"
],
"entry_count": 6
},
{
"type": "unicode_string",
"category_group": "unicode",
"description": "Strings with combining marks, bidi overrides, zero-width characters, and homoglyphs.",
"categories": [
"astral_plane",
"bidi_override",
"byte_order_mark",
"combining_diacritic",
"combining_mark_stack",
"homoglyph",
"mixed_script",
"variation_selector",
"zero_width_space"
],
"entry_count": 9
},
{
"type": "uuid",
"category_group": "identifiers",
"description": "Syntactically valid UUIDs at sentinel and formatting boundaries.",
"categories": [
"invalid_version_nibble",
"max_uuid",
"nil_uuid",
"unhyphenated_form",
"uppercase_hex"
],
"entry_count": 5
}
],
"formats": [
"csv",
"json",
"text"
],
"max_count": 500
}
curl --location --request GET 'https://zylalabs.com/api/13372/unicode+internationalization+test+data+generator+api/28543/list+available+types+and+categories' --header 'Authorization: Bearer YOUR_API_KEY'
After signing up, every developer is assigned a personal API access key, a unique combination of letters and digits provided to access to our API endpoint. To authenticate with the Unicode Internationalization Test Data Generator API simply include your bearer token in the Authorization header.
| Header | Description |
|---|---|
Authorization
|
Required
Should be Bearer access_key. See "Your API Access Key" above when you are subscribed.
|
No long-term commitment. Upgrade, downgrade, or cancel anytime. Free Trial includes up to 50 requests.
(Save 2 months with annual billing 🎉)
Trusted by leading companies
Edge case test data for QA and fuzz testing: Unicode, injection probes, boundary dates, float precision. 16 types, reproducible seeds, and every value explains what it breaks.
Edge case test data is input that is technically valid but sits at the boundaries where software commonly fails—leap-day dates, integers at 32-bit limits, names containing apostrophes, emoji made of multiple code points, and filenames reserved by Windows. Ordinary fake-data generators produce plausible data; edge case data is what actually finds bugs.
Faker, Mockaroo and similar tools optimize for realistic-looking data—plausible names, addresses, and dates. This API does the opposite: every value is chosen because it breaks something. It also tells you what it breaks, so a failing test is immediately diagnosable rather than a mystery.
A plain-English explanation of the specific failure mode that value is designed to expose — for example, that 0.30000000000000004 is the real result of 0.1 + 0.2 in IEEE 754 arithmetic and will fail an equality check against 0.3. It turns a raw string into a documented test case.
Yes. Pass a seed and the same values are returned every time, permanently, on the /v1 endpoints — safe to pin into CI fixtures. Omit the seed and a random one is generated and returned in the response so you can reproduce that exact run later.
Sixteen types across eight groups: Unicode strings and emoji sequences, person and organization names, emails and email display names, dates and datetimes, integers and floats, UUIDs and file paths, postal codes and phone numbers, and JSON keys and values.
Yes. POST /v1/generate accepts a fields object mapping your own field names to types, and returns up to 500 complete rows — up to 20 fields each — ready to seed a database or a CI fixture.
It includes canonical, harmless detection probes of the kind published in standard security testing guides — an SQL tautology, a basic XSS probe, a path traversal string. These are for testing your own input handling. There are no working exploits, shell payloads, or CVE-specific attack chains.
It distinguishes two different risks. "False" means the value is unsafe to render raw in a UI—a bidirectional override that can visually spoof a filename, for instance. "True" means it is safe to display as inert text, even though it may still break backend code that processes it. Filter on it if you show generated values to users.
Yes — format=csv, plus format=text for one raw value per line. By default, CSV cells that would trigger spreadsheet formula execution are neutralised. Set csv_escape=false if you are deliberately testing your own CSV import handling.
No. The API is stateless with no database. Nothing you request and nothing generated for you is ever written to logs — only request metadata such as endpoint, status code, and which type was requested.
To obtain your API key, first sign in to your account and navigate to the API you want to use. From the API's Pricing section, choose a plan and complete the subscription process. Once subscribed, return to the API page and you will see your API Access Key displayed at the top of the documentation page. You can use this key to authenticate your requests.
You can’t switch APIs during the free trial. If you subscribe to a different API, your trial will end and the new subscription will start as a paid plan.
The free trial lasts for 7 days and allows you to make up to 50 API requests.
No, the free trial is available only once, so we recommend using it on the API that interests you the most. Most of our APIs offer a free trial, but some may not include this option.
Yes. If the API offers a free trial, you will see a "Free 7-Day Trial" option in its Pricing section. The trial lasts for 7 days and allows up to 50 API requests, enabling you to evaluate the API before subscribing to a paid plan.
Zyla API Hub is like a big store for APIs, where you can find thousands of them all in one place. We also offer dedicated support and real-time monitoring of all APIs. Once you sign up, you can pick and choose which APIs you want to use. Just remember, each API needs its own subscription. But if you subscribe to multiple ones, you'll use the same key for all of them, making things easier for you.
You can monitor your API usage through the response headers included with every request:
x-zyla-api-calls-monthly-used: Shows the total number of API requests you have used during the current billing period.
x-zyla-api-calls-monthly-remaining: Shows the number of API requests you have remaining for the current billing period.
Yes, you can cancel your subscription at any time. Simply go to the Pricing section of the API you're subscribed to and click the "Unsubscribe" button.
Please note that upgrades, downgrades, and cancellations take effect immediately. Once your subscription is canceled, access to the service will end immediately, regardless of any remaining API calls in your quota.
Please have a look at our Refund Policy: https://zylalabs.com/terms#refund