diff --git a/tests/test_api.py b/tests/test_api.py
index dfcf505..30c61be 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -1,55 +1,35 @@
-from unittest.mock import AsyncMock
-
-from fastapi.testclient import TestClient
-
-from app.models import CurrentStatus, State, utcnow
+import httpx
+import pytest
 
 
-def create(client: TestClient, url: str = "https://example.com/health") -> dict:
-    response = client.post("/v1/monitors", json={"name": "web", "url": url})
-    assert response.status_code == 201
-    return response.json()
+@pytest.mark.anyio
+async def test_crud_check_status_and_operations(client: httpx.AsyncClient) -> None:
+    created = await client.post("/monitors", json={"name": "Example", "url": "https://example.com/a?token=secret"})
+    assert created.status_code == 201
+    monitor_id = created.json()["id"]
+    assert created.json()["status"]["state"] == "unknown"
+    assert (await client.get("/monitors")).json()[0]["name"] == "Example"
 
-
-def test_crud_and_status(client: TestClient) -> None:
-    item = create(client)
-    assert item["current_status"]["state"] == "unknown"
-    assert client.get("/v1/monitors").json()[0]["id"] == item["id"]
-    changed = client.patch(f"/v1/monitors/{item['id']}", json={"name": "api"})
+    changed = await client.patch(f"/monitors/{monitor_id}", json={"name": "Changed"})
     assert changed.status_code == 200
-    assert changed.json()["name"] == "api"
-    assert client.get(f"/v1/monitors/{item['id']}/status").json()["state"] == "unknown"
-    assert client.delete(f"/v1/monitors/{item['id']}").status_code == 204
-    missing = client.get(f"/v1/monitors/{item['id']}")
-    assert missing.status_code == 404
-    assert missing.json()["error"]["code"] == "monitor_not_found"
+    assert changed.json()["name"] == "Changed"
 
-
-def test_validation_and_operations(client: TestClient) -> None:
-    assert client.post("/v1/monitors", json={"name": "x", "url": "file:///tmp/x"}).status_code == 422
-    assert client.post("/v1/monitors", json={"name": "x", "url": "https://u:p@example.com"}).status_code == 422
-    assert client.get("/healthz").json() == {"status": "ok"}
-    ready = client.get("/readyz").json()
-    assert ready == {"status": "ready", "storage": "process-local-memory"}
-
-
-def test_check_updates_current_status(client: TestClient) -> None:
-    item = create(client)
-    result = CurrentStatus(state=State.UP, checked_at=utcnow(), latency_ms=2,
-                           http_status=204, final_url="https://example.com/health")
-    client.app.state.checker.check = AsyncMock(return_value=result)
-    checked = client.post(f"/v1/monitors/{item['id']}/check")
+    checked = await client.post(f"/monitors/{monitor_id}/check")
     assert checked.status_code == 200
-    assert checked.json()["state"] == "up"
-    stored = client.get(f"/v1/monitors/{item['id']}/status").json()
-    assert stored["http_status"] == 204
+    assert checked.json()["status"]["state"] == "up"
+    assert "token" not in checked.json()["url"]
+    assert (await client.get(f"/monitors/{monitor_id}/status")).json()["http_status"] == 204
+    assert (await client.get("/healthz")).json() == {"status": "ok"}
+    assert (await client.get("/readyz")).status_code == 200
+
+    assert (await client.delete(f"/monitors/{monitor_id}")).status_code == 204
+    missing = await client.get(f"/monitors/{monitor_id}")
+    assert missing.status_code == 404
+    assert missing.json()["error"]["code"] == "http_404"
 
 
-def test_outbound_error_is_recorded_not_raised(client: TestClient) -> None:
-    item = create(client)
-    result = CurrentStatus(state=State.ERROR, checked_at=utcnow(), latency_ms=1,
-                           error="timeout")
-    client.app.state.checker.check = AsyncMock(return_value=result)
-    response = client.post(f"/v1/monitors/{item['id']}/check")
-    assert response.status_code == 200
-    assert response.json()["error"] == "timeout"
+@pytest.mark.anyio
+async def test_validation_error_has_contract_shape(client: httpx.AsyncClient) -> None:
+    response = await client.post("/monitors", json={"name": "", "url": "file:///etc/passwd"})
+    assert response.status_code == 422
+    assert response.json()["error"]["code"] == "validation_error"