api-testing

API Testing — Automated Endpoint Validation

Test REST and GraphQL APIs with automated validation. Verify endpoints, status codes, response schemas, performance, and security. Ensure API contracts are maintained across changes.

When to Use

• Testing REST/GraphQL endpoints
• Validating API responses
• Contract testing between services
• Performance testing APIs
• Security testing endpoints
• CI/CD API validation

Testing Approaches

1. Manual Testing (curl)

# GET request
curl -X GET https://api.example.com/users

# POST with JSON
curl -X POST https://api.example.com/users \
  -H "Content-Type: application/json" \
  -d '{"name": "John", "email": "[email protected]"}'

# With authentication
curl -X GET https://api.example.com/profile \
  -H "Authorization: Bearer YOUR_TOKEN_HERE"

# Save response
curl -X GET https://api.example.com/users -o response.json

# Show headers
curl -i https://api.example.com/users

# Verbose output
curl -v https://api.example.com/users

2. Automated Testing (Python + requests + pytest)

import requests
import pytest

BASE_URL = "https://api.example.com"

def test_get_users():
    response = requests.get(f"{BASE_URL}/users")
    
    # Status code
    assert response.status_code == 200
    
    # Response structure
    data = response.json()
    assert isinstance(data, list)
    assert len(data) > 0
    
    # First user structure
    user = data[0]
    assert "id" in user
    assert "name" in user
    assert "email" in user

def test_create_user():
    payload = {
        "name": "John Doe",
        "email": "[email protected]"
    }
    
    response = requests.post(
        f"{BASE_URL}/users",
        json=payload
    )
    
    assert response.status_code == 201
    data = response.json()
    assert data["name"] == payload["name"]
    assert data["email"] == payload["email"]
    assert "id" in data

def test_authentication_required():
    response = requests.get(f"{BASE_URL}/profile")
    assert response.status_code == 401

def test_invalid_data():
    payload = {"name": ""}  # Invalid: empty name
    response = requests.post(
        f"{BASE_URL}/users",
        json=payload
    )
    assert response.status_code == 400
    assert "error" in response.json()

def test_not_found():
    response = requests.get(f"{BASE_URL}/users/99999")
    assert response.status_code == 404