Flask routing: application factories, converters and test clients

Operation contract

The factory creates the application and registers a receipt route with an integer URL converter. The view returns JSON for positive IDs and rejects zero explicitly. A local test client requests valid, invalid and missing routes without binding a network port. Converting a path segment to int only establishes its shape; it does not establish that the requested receipt belongs to the caller.

Failure and ownership boundary

The amount is fixture data. There is no database, identity, authorization or deployed server here. TESTING lets tests inspect failures, and the development server is not a production deployment plan. Flask JSON API: reject unknown fields, booleans and oversized bodies adds another boundary; Python SQLite project: transactional batches, duplicate IDs and reopen checks remains a separate local project until deliberately wired into an API.

Tested environment

Dependency check: this program was executed on CPython 3.14.6 with Flask==3.1.3. Install these versions in a separate virtual environment. The download includes the recorded environment snapshot; no third-party package is part of the website runtime.

Working program

from flask import Flask, abort

def create_application():
    application = Flask(__name__)
    application.config["TESTING"] = True
    @application.get("/receipts/<int:receipt_id>")
    def receipt(receipt_id):
        if receipt_id <= 0:
            abort(400)
        return {"receipt_id": receipt_id, "amount_minor": 125}
    return application

client = create_application().test_client()
response = client.get("/receipts/41")
print(response.status_code, response.get_json())
print(client.get("/receipts/0").status_code)
print(client.get("/receipts/not-an-id").status_code)

Output

200 {'amount_minor': 125, 'receipt_id': 41}
400
404

Costs and limits

The test performs three local dispatches with tiny responses. It does not measure proxy behavior, network concurrency or production throughput.

Common Mistakes

• A URL converter is not a record-level authorization check.
• A test client is not evidence that a service is deployed or listening.

Connected lessons

Flask JSON API: reject unknown fields, booleans and oversized bodies, Python functions: define units, validate input and return a result, Python SQLite project: transactional batches, duplicate IDs and reopen checks, Web APIs.