https://www.linkedin.
com/in/anshulagarwal30/
Practical Guide to API Testing
ere are somecommonly used HTTP status codesand their meanings, along with
H
examples of valid live APIs for testing:
Common HTTP Status Codes and Their Meanings
1. 200 OK
○ Meaning: The request was successful, and the serverreturned the expected
response.
○ Example: A successful GET request to retrieve data.
○ Live API Example:
■ GET https://jsonplaceholder.typicode.com/posts/1
■ This returns a specific post from a sample JSON API.
2. 201 Created
○ Meaning: The request has been fulfilled, and a newresource was created.
○ Example: A POST request that creates a new resourceon the server.
○ Live API Example:
■ POST https://jsonplaceholder.typicode.com/posts
■ Sending JSON data in the body to create a new post.
3. 204 No Content
○ Meaning: The request was successful, but there isno content to return.
○ Example: A DELETE request where the resource was deletedsuccessfully.
○ Live API Example:
■ DELETE https://jsonplaceholder.typicode.com/posts/1
■ This deletes a specific post and returns no content.
4. 400 Bad Request
○ Meaning: The server could not understand the requestdue to invalid syntax.
○ Example: A malformed request that the server can’tprocess.
○ Live API Example:
■ GET https://jsonplaceholder.typicode.com/posts/abc
■ Trying to request a post with an invalid ID will return a 400 error.
5. 401 Unauthorised
○ Meaning: Authentication is required, and the useris not authenticated.
○ Example: Accessing a protected resource without validcredentials.
○ Live API Example:
■ GET https://reqres.in/api/secure-endpoint
■ Accessing a secure endpoint without proper authentication.
6. 403 Forbidden
○ Meaning: The request is valid, but the server refuses to authorize it.
○ Example: Trying to access a restricted resource.
○ Live API Example:
https://www.linkedin.com/in/anshulagarwal30/
G
■ ET https://jsonplaceholder.typicode.com/admin
■ Accessing a restricted resource that you don’t have permission to
access.
7. 404 Not Found
○ Meaning: The server cannot find the requested resource.
○ Example: A GET request to a non-existent endpointor resource.
○ Live API Example:
■ GET https://jsonplaceholder.typicode.com/posts/12345
■ Requesting a post that does not exist.
8. 500 Internal Server Error
○ Meaning: The server encountered an unexpected conditionthat prevented it
from fulfilling the request.
○ Example: A server misconfiguration or issue causesthe error.
○ Live API Example:
■ GET https://httpstat.us/500
■ This returns a 500 error to simulate a server issue.
9. 502 Bad Gateway
○ Meaning: The server, while acting as a gateway orproxy, received an invalid
response from the upstream server.
○ Example: A server in the middle cannot process therequest properly.
○ Live API Example:
■ GET https://httpstat.us/502
■ This returns a 502 error to simulate a bad gateway issue.
10.503 Service Unavailable
○ Meaning: The server is temporarily unable to handlethe request due to
maintenance or overload.
○ Example: A server under maintenance or experiencinghigh load.
○ Live API Example:
■ GET https://httpstat.us/503
■ This returns a 503 error to simulate a service unavailability.
Live APIs for Testing:
1. JSONPlaceholder API:
○ A free online REST API for testing and prototyping.
https://jsonplaceholder.typicode.com/
○ Base URL:
○ Example Endpoints:
■
GET https://jsonplaceholder.typicode.com/posts
■
POST
https://jsonplaceholder.typicode.com/posts
https://www.linkedin.com/in/anshulagarwal30/
2. ReqRes:
○ A hosted REST API that simulates user management scenarios.
https://reqres.in/
○ Base URL:
○ Example Endpoints:
■
GET https://reqres.in/api/users
■ POST https://reqres.in/api/users
3. HTTP Stat.us:
○ A simple service to return different HTTP status codes for testing.
https://httpstat.us/
○ Base URL:
○ Example Endpoints:
■
GET https://httpstat.us/200
■ GET https://httpstat.us/404
4. The Dog API:
○ A fun API that returns pictures and information about dogs.
https://thedogapi.com/
○ Base URL:
○ Example Endpoints:
■
GET https://api.thedogapi.com/v1/breeds
■
GET https://api.thedogapi.com/v1/images/search
step-by-step practical guide to API testing, with examples using Postman and
A
Rest Assured.
1. Understanding API Basics
PIstands forApplication Programming Interface,a set of rules that define how software
A
components should interact. APIs typically use HTTP requests to communicate, which can
involve the following methods:
● ET: Retrieve data from a server.
G
● POST: Send data to a server to create a new resource.
● PUT: Update an existing resource.
● DELETE: Remove a resource from the server.
2. Setting Up Tools for API Testing
For this guide, we’ll use two common tools:
P
● ostman: A user-friendly GUI tool for testing APIs.
● Rest Assured: A Java-based API testing library forautomation testing.
https://www.linkedin.com/in/anshulagarwal30/
3. Using Postman for API Testing
Step 1: Install Postman
Download and install Postman from Postman’s official website.
Step 2: Create a New Request
O
● pen Postman, and clickNew>Request.
● Select the request type (e.g., GET, POST) and enter the API URL. For example:
○
GET https://jsonplaceholder.typicode.com/posts/1
Step 3: Add Parameters/Body
● If needed, add query parameters or request body inParamsorBodytabs.
Step 4: Send Request
● ClickSendand examine the response (e.g., StatusCode, JSON data).
Step 5: Writing Tests
● In theTeststab, write simple assertions using JavaScript:
javascript
pm.test("Status code is 200", function () {
pm.response.to.have.status(200);
});
Step 6: Collection Runs and Automation
● G
roup your requests intocollectionsand automatethem using Postman’s
Collection Runnerfor repeated testing.
4. Using Rest Assured for API Automation
Rest Assuredis a powerful tool for automating APItests in a Java environment.
Step 1: Set Up Rest Assured
pom.xml(for Maven projects):
Add Rest Assured as a dependency in your
https://www.linkedin.com/in/anshulagarwal30/
xml
<dependency>
<groupId>io.rest-assured</groupId>
<artifactId>rest-assured</artifactId>
<version>4.4.0</version>
<scope>test</scope>
</dependency>
Step 2: Writing a Basic Test
Here’s a simple example of testing aGETrequest usingRest Assured:
java
import io.restassured.RestAssured;
import io.restassured.response.Response;
import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;
public class ApiTest {
public static void main(String[] args) {
RestAssured.baseURI =
"https://jsonplaceholder.typicode.com";
// Simple GET request
given()
.when()
.get("/posts/1")
https://www.linkedin.com/in/anshulagarwal30/
.then()
.statusCode(200)
.body("userId", equalTo(1));
}
}
Step 3: Running the Test
U
● se a testing framework likeJUnitorTestNGto runyour test cases.
● Execute the test with assertions to validate the status code and response body.
5. Key API Testing Concepts
1. S tatus Code Validation: Verify the status code ineach response. Common status
codes include:
○ 200 OK: Request was successful.
○ 201 Created: Resource created successfully.
○ 400 Bad Request: Invalid request syntax.
○ 401 Unauthorised: Authentication required.
○ 500 Internal Server Error: Server encountered an error.
2. Response Body Validation: Ensure the returned datamatches expectations. Use
assertions to check specific fields:
java
body("title", equalTo("foo"))
3. Header Validation: Validate HTTP headers for securityand content:
java
header("Content-Type", "application/json; charset=utf-8")
https://www.linkedin.com/in/anshulagarwal30/
4. A
uthentication: Some APIs require authentication. Add authorization tokens in the
Headerssection in Postman or pass tokens in Rest Assured:
java
given().auth().oauth2("YOUR_ACCESS_TOKEN")
5. Negative Testing: Send invalid data to test how theAPI handles errors.
6. Advanced Techniques
1. P arameterized Tests: Reuse test cases with differentsets of input data using
variables or environments.
2. Data-Driven Testing: Use CSV or JSON files to inputmultiple datasets in automated
tests.
3. Mocking APIs: Use tools likePostman Mock ServersorWireMockto simulate
APIs that may not be fully developed yet.
7. Reporting and Continuous Integration
● U se tools likeNewman(Postman’s command-line runner)to integrate API tests into
yourCI/CD pipelines.
● For Rest Assured, combine with reporting frameworks likeExtent Reportsfor
detailed results.
8. API Testing Best Practices
1. C lear Test Cases: Ensure your test cases cover allscenarios, including happy paths
and edge cases.
2. Independent Tests: API tests should not depend oneach other to avoid false
negatives.
3. Monitor APIs: After testing, set up API monitoringusing tools likePostman
Monitorsto catch downtime or slow performance.
Conclusion
PI testing is critical to ensuring that your backend services perform reliably. Whether you
A
use Postman for manual testing or automate your API tests with Rest Assured, following this
guide will help ensure that your APIs meet functionality, performance, and reliability
expectations.
