API Testing
Masterclass

What is an API?

An Application Programming Interface (API) is a set of rules and protocols that allows different software applications to communicate with each other. Think of it as a waiter in a restaurant who takes your order (request) to the kitchen (server) and brings back your food (response).

The Five Essential HTTP Methods

HTTP methods define the type of action you want to perform on a resource. Here are the most common ones:

Understanding Server Responses

Every API response includes a status code. For QA, these are the first checkpoint for any bug.

Interactive API Request Builder

Make a real API request and see how it works! We'll use free testing APIs.

⚠️ Browser Limitation: Some APIs may show CORS errors in browsers. This is a security feature. The APIs listed in the "Free APIs for Practice" section below all work! For unrestricted testing, use Postman desktop app.

Understanding CORS (Why Some APIs Don't Work in Browsers)

CORS stands for Cross-Origin Resource Sharing. It's a security feature built into web browsers that prevents websites from making requests to different domains without permission.

This is exactly why Postman is the industry standard for API testing!

What is Postman?

Postman is a powerful tool for testing and developing APIs. It provides a user-friendly interface to send requests, examine responses, and organize your API tests into collections.

Making Your First Request in Postman

Test Your Skills with These Free APIs

No authentication required - perfect for learning!

Authentication in Detail

Most modern APIs require authentication. For QA/SDETs, understanding how to generate and pass these credentials is crucial.

// Header
x-api-key: 12345-abcde-67890

// Query Param
GET /users?api_key=12345-abcde

Authorization: Bearer eyJhbGciOiJIUzI1NiIsIn...

Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Request Headers

Headers provide additional information about the request. Common headers include:

Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Accept: application/json
User-Agent: Postman/10.0.0

Query Parameters

Parameters appended to URLs to filter, sort, or paginate data:

https://api.example.com/users?page=2&limit=10&sort=name

// Breaking it down:
?        Start of query parameters
page=2   Get page 2 of results
&        Separator between parameters
limit=10 Show 10 items per page
sort=name Sort results by name

Request Body

Data sent with POST, PUT, and PATCH requests, typically in JSON format:

{
  "firstName": "Jane",
  "lastName": "Doe",
  "email": "[email protected]",
  "age": 28,
  "isActive": true
}

Response Structure

API responses typically include status codes, headers, and a body with data or error information.

// Successful Response (200 OK)
{
  "status": "success",
  "data": {
    "id": 123,
    "name": "John Doe"
  }
}

// Error Response (404 Not Found)
{
  "status": "error",
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

Pagination Strategies

When dealing with large datasets, APIs return data in chunks instead of all at once.

// Page 3 with 10 items per page
GET /api/items?page=3&limit=10

// Response includes pagination metadata
{
  "data": [...],
  "pagination": {
    "page": 3,
    "limit": 10,
    "total": 150,
    "totalPages": 15
  }
}

// Response includes cursor for next page
{
  "data": [...],
  "nextCursor": "eyJpZCI6MTIzfQ==",
  "hasMore": true
}

// Use cursor in next request
GET /api/posts?cursor=eyJpZCI6MTIzfQ==&limit=20

Rate Limiting

APIs limit requests to prevent abuse and ensure fair usage.

// Rate limit headers in response
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 999
X-RateLimit-Reset: 1642780800

// 429 Too Many Requests
{
  "error": "Rate limit exceeded",
  "retryAfter": 3600
}

API Versioning

Versioning ensures new changes don't break existing applications.

Idempotency

An idempotent operation produces the same result no matter how many times it's executed.

// Make POST idempotent
POST /api/payments
Idempotency-Key: unique-key-123

Webhooks

Server pushes updates to your app when events occur instead of you polling.

// Register webhook
POST /api/webhooks
{
  "url": "https://myapp.com/webhook",
  "events": ["payment.success"]
}

// Server sends POST when event occurs
POST https://myapp.com/webhook
{
  "event": "payment.success",
  "data": {...}
}

Caching

Reduce server load by caching frequently accessed data.

Cache-Control: public, max-age=3600
ETag: "33a64df5"

// Client checks if cached version is still valid
If-None-Match: "33a64df5"

// Server returns 304 if unchanged