API Testing · Beginner to job‑ready

API in Software Testing: What, Why, How — Complete Tutorial

SECTION 01What is API testing?

API testing is a type of software testing that verifies that APIs (Application Programming Interfaces) meet expectations for functionality, reliability, performance, and security. Unlike UI testing, API testing is performed at the message layer — directly testing the business logic and data responses without a graphical interface.

In simple terms: API in software testing means checking if the "behind the scenes" communication between different software systems works correctly.

SECTION 02Why is API testing important?

• Early bug detection — APIs are tested before the UI is ready, catching issues early in the development cycle.
• Reduces cost — fixing bugs at the API layer is cheaper than fixing them at the UI layer.
• Improves test coverage — APIs cover the business logic and data layers, which are often missed in UI-only testing.
• Ensures security — APIs are a common attack vector; testing them for vulnerabilities is critical.
• Enables automation — API tests are fast, reliable, and easy to automate in CI/CD pipelines.

According to industry data, API testing can reduce overall testing effort by up to 40% while increasing coverage significantly.

SECTION 03Types of API testing

1. Functional Testing

Verifies that the API performs its intended functions correctly — returns the right data, handles edge cases, and responds with appropriate status codes.

• Example: Sending a GET /users request and verifying the response contains the correct user list.
• Tools: Postman, RestAssured, SoapUI.

2. Security Testing

Ensures the API is secure from threats — authentication, authorization, encryption, and vulnerability checks.

• Example: Attempting to access an endpoint without a valid token.
• Common checks: SQL injection, XSS, token expiration, rate limiting.
• Tools: OWASP ZAP, Burp Suite, Postman (with security scripts).

3. Performance Testing

Measures how the API behaves under load — response time, throughput, and resource usage.

• Example: Simulating 1,000 concurrent users hitting the POST /orders endpoint.
• Key metrics: Response time (p95, p99), throughput, error rate.
• Tools: JMeter, LoadRunner, k6.

4. Integration Testing

Verifies that the API works correctly with other APIs, databases, and third-party services.

• Example: Testing that the API correctly writes to a database and sends a notification to a third-party service.

5. Contract Testing

Ensures that the API meets the expectations of its consumers — checking the request/response format, fields, and data types.

• Example: Using Pact or OpenAPI specification to validate that the API matches its contract.

SECTION 04API testing tools

SECTION 05How to test an API — step by step

Here's a practical approach to API testing, using a simple REST API as an example.

1. Understand the API contract — Review the API documentation (OpenAPI/Swagger). Know the endpoints, methods, request/response formats, and authentication requirements.
2. Set up the test environment — Use a tool like Postman or a scripting framework. Configure your test data, environment variables, and authentication tokens.
3. Write positive test cases — Test the "happy path" first. Send valid requests and verify that responses are correct (status code 2xx, proper body).
4. Write negative test cases — Test edge cases: invalid input, missing fields, unauthorized access, malformed data. Verify that the API returns appropriate error codes (4xx, 5xx).
5. Automate and run in CI/CD — Integrate your API tests into your CI/CD pipeline (Jenkins, GitHub Actions, GitLab CI). Run tests on every commit.
6. Monitor and maintain — Regularly review test results, update tests as the API evolves, and add new test cases for new features.

// Postman test script (pm.test)
pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("Response body has users array", function () {
    const jsonData = pm.response.json();
    pm.expect(jsonData).to.be.an('array');
    pm.expect(jsonData.length).to.be.greaterThan(0);
});

pm.test("User has correct fields", function () {
    const jsonData = pm.response.json();
    jsonData.forEach(user => {
        pm.expect(user).to.have.property('id');
        pm.expect(user).to.have.property('name');
        pm.expect(user).to.have.property('email');
    });
});

// RestAssured test (Java)
import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;

@Test
public void testGetUsers() {
    given()
        .header("Authorization", "Bearer " + token)
        .param("page", "1")
    .when()
        .get("https://api.example.com/users")
    .then()
        .statusCode(200)
        .body("size()", greaterThan(0))
        .body("[0].id", notNullValue())
        .body("[0].name", notNullValue())
        .body("[0].email", notNullValue())
        .time(lessThan(500L));
}

// Supertest (JavaScript/Node.js)
const request = require('supertest');
const app = require('../app');

describe('GET /api/users', () => {
    it('should return 200 and array of users', async () => {
        const res = await request(app)
            .get('/api/users')
            .set('Authorization', 'Bearer ' + token)
            .query({ page: 1 });

        expect(res.statusCode).toBe(200);
        expect(res.body).toBeInstanceOf(Array);
        expect(res.body.length).toBeGreaterThan(0);
        expect(res.body[0]).toHaveProperty('id');
        expect(res.body[0]).toHaveProperty('name');
        expect(res.body[0]).toHaveProperty('email');
    });
});

SECTION 06API testing best practices

• Test both positive and negative scenarios — don't just test the happy path. Send invalid inputs, missing fields, and unexpected data types.
• Use proper authentication — always test with valid and invalid tokens. Test token expiration and refresh flows.
• Validate status codes — ensure your API returns the correct HTTP status codes (2xx, 4xx, 5xx) for different scenarios.
• Check response body format — verify that the response structure matches the contract (OpenAPI/JSON schema).
• Test error messages — ensure error messages are clear, consistent, and helpful for debugging.
• Maintain test independence — each test should be able to run independently without depending on the order of execution.
• Use environment variables — never hard-code URLs, tokens, or credentials in your test scripts.
• Run tests in CI/CD — automate API tests as part of your deployment pipeline to catch issues early.
• Monitor test flakiness — if a test fails intermittently, investigate and fix it immediately.

SECTION 07Common API errors & fixes

SECTION 08Interview Q&A — API testing

SECTION 09Test yourself — API testing quiz

SECTION 10Frequently asked questions

SECTION 11Continue from here