API Testing
Quick REST API guide: what an API is, types (REST, SOAP, GraphQL, gRPC), relevant tests, HTTP codes, methods, endpoints and metadata.
An API (Application Programming Interface) is a set of rules and protocols that lets two different applications communicate. It is like a bridge connecting systems to exchange information or trigger actions.
- Connect systems.
- Ease integration between applications, services or devices.
- Reuse functionality without reprogramming it from scratch.
- Standardize communication between software.
API types
| Feature | REST | SOAP | GraphQL | gRPC |
|---|---|---|---|---|
| Model | Resources and HTTP methods | XML messages with rigid contracts (WSDL) | Client-defined queries and mutations | Remote procedure calls (RPC) |
| Format | Usually JSON | XML only | JSON | Protocol Buffers (binary) |
| Flexibility | Medium: returns the full resource | Low: fixed, strict structure | Very high: client asks only for what it needs | Medium: contracts in .proto files |
| Ease of testing | High: Postman, Playwright, curl | Medium: validate XML and WSDL | Medium-high: build queries | Medium-low: needs special tooling |
Most relevant tests
- Validate HTTP status codes.
- Check the response body: data types, consistent structure, required fields.
- Confirm input validation with invalid, incomplete or overly long data.
- Test security: authenticated endpoints, expired or invalid tokens.
- Evaluate error message consistency: clear and without exposing sensitive information.
- Check headers and metadata: Authorization, Content-Type, Cache-Control.
- Test performance and limits under many requests.
- Validate compatibility and versioning: changes should not break old clients.
HTTP status codes
| Code | Meaning | Description |
|---|---|---|
| 200 | OK | Successful request. |
| 201 | Created | Resource created successfully. |
| 400 | Bad Request | Malformed request or invalid data. |
| 401 | Unauthorized | Missing authentication (invalid token/API key). |
| 403 | Forbidden | Authenticated, but without permission. |
| 404 | Not Found | The resource does not exist. |
| 500 | Internal Server Error | Generic server error. |
| 503 | Service Unavailable | Service unavailable (maintenance or overload). |
Base URL and endpoints
The base URL is the API’s entry point; endpoints are built from it by adding resource-specific paths. Defining it once provides consistency, eases configuration (Postman, Playwright) and enables versioning without breaking compatibility.
https://api.example.com/v1 ← base URL (protocol + domain + version)
https://api.example.com/v1/users ← endpoint: list of users
https://api.example.com/v1/users/123 ← endpoint: user 123HTTP methods
GET — Retrieve data
Retrieves information without modifying it. Idempotent, safe and bodyless.
POST — Create resources
Creates new resources or processes data. Not idempotent, not safe, with a body.
PUT — Full update
Completely replaces an existing resource. Idempotent; may create if it does not exist.
PATCH — Partial update
Modifies only the sent fields. More efficient for minor changes.
DELETE — Delete
Removes a resource from the server. Idempotent, bodyless and destructive.
Metadata (headers)
| Header | Function |
|---|---|
| Authorization | Sends credentials for authentication (token, Basic Auth). |
| Cache-Control | Indicates how to handle the cache. |
| Content-Type / Accept | Define the content type sent and accepted (e.g. application/json). |
| Host | Specifies the server domain the request targets. |
| User-Agent | Identifies the client making the request. |
Testing tools
Manual and automated: Postman (with JavaScript) and Playwright (with TypeScript). Tip: define the base URL in one place (variable {{URL}} or playwright.config.ts) and reuse it in every endpoint.
Save or share this content
Download it as PDF or Markdown to save or share it.