API Testing Fundamentals

# CHAPTER 8

API Testing Fundamentals #

1. Introduction #

2. Learning Objectives #

• Define what an API is and why testing it directly is highly efficient.

• Understand REST architecture and the standard HTTP Methods (GET, POST, PUT, DELETE).

• Interpret HTTP Status Codes (200s, 400s, 500s).

• Validate JSON response payloads and schemas.

• Use Postman to execute and automate basic API tests.

3. Why Test the API Directly? #

• Speed: Clicking through a UI to create a user account takes 5 seconds. Sending a POST request to an API to create a user takes 0.05 seconds.

• Stability: UIs change constantly (buttons move, CSS classes change), which breaks UI automation tests. APIs rarely change their underlying data structures.

• Security: Hackers do not use your UI. They bypass the UI and attack the API directly. QA must test the API to ensure it rejects bad data.

4. The REST API Mechanics #

• Endpoint/URL: Where are you sending the data? (e.g., https://api.example.com/users)

• HTTP Method: What action are you taking?

• GET: Fetch data (Read).

• POST: Create new data.

• PUT: Update existing data.

• DELETE: Remove data.

• Headers: Metadata (e.g., Auth Tokens).

• Body/Payload: The JSON data you are sending (used in POST/PUT).

5. Analyzing the API Response #

1. 1. Status Code: Did it succeed?

• 2xx (Success)

• 4xx (Client Error - You sent bad data, e.g., 400 Bad Request, 401 Unauthorized)

• 5xx (Server Error - The backend crashed, e.g., 500 Internal Server Error)

1. 2. Response Body: Is the JSON data correct? Does the returned user have the correct ID and name?

1. 3. Response Time: Did the API reply in under 500ms?

6. Code and Automation Examples #

{
  "email": "testuser@example.com",
  "password": "SecurePassword123"
}

Example: The Expected JSON Response *What QA verifies upon receiving the response:*

{
  "status": "success",
  "data": {
    "user_id": 99,
    "email": "testuser@example.com"
  }
}

7. Tools of the Trade: Postman #

• Manual Execution: Testers use Postman's GUI to construct requests, attach JSON bodies, add authorization headers, and click "Send" to view the response.

• Automation: Postman allows testers to write JavaScript assertions that automatically validate the response.

8. Best Practices #

• Test the "Unhappy Path": Sending a valid email/password to the /login endpoint is easy. A great API tester sends an empty JSON body, a massive 5MB text string, or an SQL injection command to ensure the API returns a controlled 400 Bad Request instead of crashing with a 500 Server Error.

9. Common Mistakes #

• Ignoring Schema Validation: Testers often check if the API returns a status 200, but forget to check the *structure* of the data. If the frontend expects the JSON key to be "firstName", but the API suddenly changes it to "first_name", the UI will break. Validating the JSON Schema is critical.

10. Mini Project: Design an API Test Suite #

1. 1. Test 1 (Positive POST): Send valid item ID. *Expect:* 201 Created. Item is in cart.

1. 2. Test 2 (Negative POST): Send an item ID that doesn't exist. *Expect:* 404 Not Found.

1. 3. Test 3 (Negative POST): Send an item ID, but no authorization token. *Expect:* 401 Unauthorized.

1. 4. Test 4 (Positive GET): Request cart items. *Expect:* 200 OK, JSON array containing the added item.

11. Practice Exercises #

1. 1. Match the following HTTP methods to their CRUD (Create, Read, Update, Delete) equivalents: GET, POST, PUT, DELETE.

1. 2. Explain why testing an API directly is significantly more robust and stable than automating clicks through a web browser UI.

12. MCQs with Answers #

13. Interview Questions #

• Q: Explain the components of an HTTP Request. If you need to send a secure API key to a server, where should you place it?

• Q: What is the difference between a 4xx series status code and a 5xx series status code? Who is "at fault" in each scenario?

• Q: Explain "JSON Schema Validation." Why is it important to test not just the data values, but the data types (e.g., ensuring an ID is returned as an Integer, not a String)?

14. FAQs #

15. Summary #

16. Next Chapter Recommendation #