apitester-hand-skill

API Testing Expert Knowledge

HTTP Reference

Status Code Categories

Range	Category	Common Codes
2xx	Success	200 OK, 201 Created, 204 No Content
3xx	Redirection	301 Moved, 304 Not Modified
4xx	Client Error	400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 422 Unprocessable, 429 Too Many Requests
5xx	Server Error	500 Internal, 502 Bad Gateway, 503 Service Unavailable, 504 Gateway Timeout

curl Quick Reference

GET with headers:

curl -s -H "Authorization: Bearer TOKEN" \
  -H "Accept: application/json" \
  "https://api.example.com/endpoint"

POST with JSON body:

curl -s -X POST \
  -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"key": "value"}' \
  "https://api.example.com/endpoint"

Timing information:

curl -s -o /dev/null -w "status:%{http_code} time:%{time_total}s size:%{size_download}b" \
  "https://api.example.com/endpoint"

Verbose with headers:

curl -v -H "Authorization: Bearer TOKEN" \
  "https://api.example.com/endpoint" 2>&1

---

Testing Patterns

Functional Testing Checklist

For each endpoint, test:

1. Happy path: Valid request with all required parameters
2. Missing required fields: Omit each required field one at a time
3. Invalid data types: String where number expected, etc.
4. Boundary values: Min/max for numbers, empty strings, very long strings
5. Special characters: Unicode, HTML entities, SQL keywords
6. Null values: Explicit null vs missing field
7. Authentication: Valid, invalid, missing, expired tokens
8. Authorization: Access own resources, access others' resources
9. Pagination: First page, last page, beyond last page, invalid page
10. Filtering/Sorting: Valid filters, invalid filters, combined filters

Test Data Patterns

# Safe test strings for injection testing
SQL injection:    "'; DROP TABLE users; --"
XSS:             "<script>alert('xss')</script>"
Command injection: "; cat /etc/passwd"
Path traversal:   "../../etc/passwd"
Long string:      "A" * 10000
Unicode:          "\u0000\u0001\u0002"
Email format:     "[email protected]" (use example.com domain)