API

Sr no. Topic Duration Session Session

(Mins) No (2 No (4
Hours) Hours)
1 Fundamentals 2 hrs 1 1
of web
services
2 Introduction 2 hrs 2 1
to API testing
3 Postman 2 hrs 3 2
basics
4 Postman 2 hrs 4 2
advanced
topics
5 Postman 2 hrs 5 3
newman
6 REST assured 2 hrs 6 4
basics
7 REST API 2 hrs 7 4
testing
8 JSON 2 hrs 8 5
manipulation
9 REST 2hrs 9 5
framework

TOPICS

1. Fundamentals of web services

API

Information

I. Introduction to Web Services

• Web services are a means of communication between

two electronic devices over a network.
• They allow different applications to exchange data
and interact with each other regardless of the
platforms or programming languages they are built
on.
• Web services follow a standardized set of protocols
and technologies to enable seamless integration and
interoperability between systems.
• At its core, a web service is a software system that
exposes a set of functionalities or resources over the
internet.
• These functionalities can be accessed by other
applications or services using standard web protocols
such as HTTP.
• Web services are based on the principles of Service-
Oriented Architecture (SOA), which promotes loose
coupling and modular design.

1. Web services are typically categorized into two main

types:
a. SOAP (Simple Object Access Protocol) and REST
(Representational State Transfer).
b. SOAP is a protocol that uses XML for message
exchange, while REST is an architectural style
that uses lightweight data formats such as JSON
or XML.
API

The key components of a web service include:

1. WSDL (Web Services Description Language):

a. It is an XML-based language that describes the
functionality provided by a web service.
b. It defines the operations, message formats, and
communication protocols.

2. SOAP (Simple Object Access Protocol):

a. It is a messaging protocol used for exchanging
structured information in web services.
b. SOAP messages are typically XML-based and sent
over HTTP.

3. REST (Representational State Transfer):

a. It is an architectural style for building web
services.
b. RESTful web services use standard HTTP
methods (GET, POST, PUT, DELETE) to perform
operations on resources.

4. Endpoint:
a. It is the URL or network address where the web
service is available for access.

• Web services are widely used for various purposes

such as integrating different systems, enabling
interoperability between applications, exposing
functionality as APIs, and facilitating machine-to-
machine communication.
API
• In summary, web services provide a standardized and
interoperable way for applications to communicate
and share data over the internet.
• They play a crucial role in modern distributed
systems and enable seamless integration between
diverse technologies.

II. Introduction to Client server Architecture

• Client-server architecture is a common model used in

computer networks to establish a communication
framework between clients and servers.
• It defines how resources and services are distributed
and accessed across a network.
• In this architecture, clients and servers are separate
entities with distinct roles and responsibilities.

The client-server architecture consists of the following

components:

1. Client:
a. The client is a software application or a device
that requests services or resources from a server.
It can be a web browser, a mobile app, or any
other application that interacts with the user.
b. Clients initiate communication by sending
requests to the server and receive responses in
return.

2. Server:
API
a. The server is a software application or a
computer that provides services or resources to
clients.
b. It listens for incoming requests from clients,
processes them, and sends back the appropriate
responses.
c. Servers can handle multiple client requests
concurrently and are responsible for managing
resources and executing requested operations.

3. Network:
a. The network acts as the medium through which
clients and servers communicate.
b. It can be a local area network (LAN) within an
organization or a wide area network (WAN) such
as the internet.
c. The network infrastructure ensures the
transmission of data between clients and servers.

The client-server architecture offers several advantages:

1. Scalability:
a. Servers can handle multiple client requests
simultaneously, allowing for efficient utilization
of resources.
b. As the number of clients increases, additional
servers can be added to distribute the load.

2. Centralized Management:
a. Servers centralize data storage and processing,
making it easier to manage and secure resources.
API
Centralized management also facilitates data
backup and recovery.

3. Resource Sharing:
a. Servers can provide shared resources such as
databases, files, and printers, allowing multiple
clients to access and use them concurrently.

4. Security:
a. Centralized servers enable better control over
access to resources, making it easier to enforce
security measures such as authentication and
authorization.

5. Interoperability:
a. Clients and servers can be implemented using
different technologies and platforms, allowing for
interoperability between heterogeneous systems.

III. Advantages of Web Services over WebBased

Application

Web services offer several advantages over web-based

applications:

1. Platform Independence:
a. Web services are built on standard protocols
such as HTTP and XML, making them platform-
independent.
API
b. They can be accessed and consumed by clients
running on different platforms and technologies,
allowing for seamless integration and
interoperability.

2. Language Neutrality:
a. Web services can be implemented using different
programming languages.
b. This language neutrality enables organizations to
choose the language that best suits their needs
and existing infrastructure without affecting the
communication between services.

3. Service Reusability:
a. Web services are designed to be modular and
reusable.
b. They expose specific functionalities or resources
as services that can be consumed by multiple
clients or applications.
c. This promotes code reuse, reduces development
effort, and improves overall system efficiency.

4. Loose Coupling:
a. Web services are loosely coupled, meaning they
are not tightly dependent on each other.
b. Clients and services can evolve independently,
allowing for flexibility in system development
and maintenance.
c. Changes in one service do not require
modifications to all dependent services, as long
as the interface remains intact.
API
5. Interoperability:
a. Web services follow standard protocols and data
formats, enabling seamless integration between
different systems and technologies.
b. They can communicate with each other
regardless of the underlying platforms or
programming languages used, making it easier to
integrate diverse systems within an organization
or across organizations.

6. Scalability:
a. Web services can handle a large number of
concurrent requests, making them scalable.
b. They can be deployed on distributed systems or
cloud environments, allowing for horizontal
scaling by adding more instances or nodes to
handle increased workloads.

7. Wide Accessibility:
a. Web services can be accessed over the internet,
making them widely accessible from anywhere
with an internet connection.
b. This accessibility enables remote clients and
applications to consume services without the
need for physical proximity to the server.

8. Standardization:
a. Web services adhere to standardized protocols,
such as SOAP (Simple Object Access Protocol)
and REST (Representational State Transfer),
ensuring consistency and compatibility across
different implementations.
API
b. This standardization simplifies the development,
integration, and maintenance of web services.

• In summary, web services offer advantages such as

platform independence, language neutrality, service
reusability, loose coupling, interoperability, scalability,
wide accessibility, and standardization.
• These advantages make web services a powerful
technology for building distributed systems, enabling
seamless integration and communication between
diverse applications and platforms.

IV. Difference between API and Web services

• APIs and web services are related concepts but differ

in their scope and implementation.

Here are the key differences between API and web

services:

1. Scope:
a. APIs (Application Programming Interfaces) are
broader in scope and can refer to any set of rules
and protocols that allow applications to
communicate with each other.
b. Web services, on the other hand, are a specific
type of API that use standard web protocols to
enable communication between different
systems over the internet.

2. Communication Protocol:
API
a. APIs can use various communication protocols,
such as HTTP, REST, SOAP, or even custom
protocols.
b. Web services, however, specifically use web
protocols like HTTP for communication, making
them accessible over the internet.

3. Data Format:
a. APIs can support different data formats,
including JSON, XML, or even binary formats.
b. Web services typically use XML or JSON as the
data format for exchanging information between
client and server.

4. Implementation:
a. APIs can be implemented in different ways,
including libraries, SDKs (Software Development
Kits), or even direct code integrations.
b. Web services, on the other hand, are
implemented as services that run on web servers
and follow specific protocols like SOAP or REST.

5. Standards and Interoperability:

a. Web services follow specific standards like SOAP
(Simple Object Access Protocol) or REST
(Representational State Transfer) to ensure
interoperability and compatibility across
different systems.
b. APIs may or may not follow such standards,
depending on the specific implementation.

6. Accessibility:
API
a. Web services are accessible over the internet,
allowing clients to communicate with them from
anywhere.
b. APIs can be accessible over different channels,
including local network connections or within a
single application.

• In summary, APIs are a broader concept that

encompasses any set of rules and protocols that allow
applications to communicate.
• Web services, on the other hand, are a specific type of
API that use web protocols and standards to enable
communication over the internet.
• Web services are a subset of APIs that specifically
focus on web-based communication using
technologies like SOAP or REST.

V. Different Types of Web services-SOAP and Rest

• There are two main types of web services: SOAP

(Simple Object Access Protocol) and REST
(Representational State Transfer).

Here's an explanation of each:

1. SOAP (Simple Object Access Protocol):

a. SOAP is a protocol for exchanging structured

information in web services using XML.
b. It uses a set of rules and standards to define the
format of the request and response messages.
API
c. SOAP supports various protocols for message
transmission, including HTTP, SMTP, and more.
d. It provides a well-defined contract through
WSDL (Web Services Description Language),
which describes the available methods, their
parameters, and data types.
e. SOAP web services are considered to be more
formal and have a stronger emphasis on
standards and contracts.

2. REST (Representational State Transfer):

a. REST is an architectural style for designing

networked applications, including web services.
b. It uses simple HTTP protocols such as GET, POST,
PUT, and DELETE to perform operations on
resources.
c. RESTful web services are stateless, meaning that
each request from the client contains all the
necessary information.
d. It is lightweight and relies on the existing
infrastructure of the web, making it easier to
implement and consume.
e. RESTful web services are flexible and can return
data in various formats, including XML, JSON, or
even plain text.
f. Unlike SOAP, REST does not rely on a strict
contract or predefined schema.

• Both SOAP and REST have their own advantages and

use cases. SOAP is often preferred in scenarios where
API
a formal contract and extensive security features are
required.
• REST, on the other hand, is popular for its simplicity,
scalability, and ease of integration with other web
technologies.
• The choice between SOAP and REST depends on the
specific requirements and constraints of the project.

VI. Microservices Introduction

• Microservices are an architectural style that

structures an application as a collection of small,
loosely coupled, and independently deployable
services.
• Each microservice is responsible for a specific
business capability and communicates with other
services through well-defined APIs.

Here are some key points about microservices:

1. Service Independence:
a. Microservices are designed to be independent
and autonomous.
b. Each service can be developed, deployed, and
scaled independently of others, allowing for
flexibility and agility in development and
deployment processes.

2. Single Responsibility:
a. Each microservice focuses on a specific business
capability or functionality.
API
b. This allows teams to work on specific services
without affecting the entire application, making
development and maintenance more
manageable.

3. Decentralized Data Management:

a. Each microservice has its own database or data
store, ensuring data autonomy.
b. This allows services to manage their data in a
way that best suits their requirements, without
relying on a centralized database.

4. Inter-Service Communication:
a. Microservices communicate with each other
through well-defined APIs, typically using
lightweight protocols such as HTTP/REST or
messaging systems.
b. This enables loose coupling between services
and allows for flexibility in technology choices.

5. Scalability and Resilience:

a. Microservices can be individually scaled based
on demand, allowing for efficient resource
utilization.
b. Additionally, if one microservice fails, it does not
impact the entire application, making the system
more resilient.

6. Continuous Deployment:
a. With independent services, it is easier to
implement continuous integration and
continuous deployment (CI/CD) practices.
API
b. Services can be developed, tested, and deployed
independently, enabling faster release cycles.

• Microservices architecture promotes modularity,

scalability, and agility in software development.
• However, it also introduces additional complexities in
terms of distributed system management, inter-
service communication, and data consistency.
• Organizations need to carefully consider factors such
as service boundaries, data consistency strategies,
and monitoring mechanisms when adopting
microservices.
• Overall, microservices offer a way to build complex
applications by breaking them down into smaller,
manageable services that can be developed, deployed,
and scaled independently.

2. Introduction to API testing

Information

I. What is an API

• API stands for Application Programming Interface.

• It is a set of rules and protocols that allow different
software applications to communicate with each
other.
• APIs define how different software components
should interact, specifying the data formats, methods,
and protocols to be used.
API
• In simpler terms, an API acts as a bridge that allows
one software application to access and use the
functionalities of another application or service.
• It enables developers to leverage existing
functionalities and data from other applications
without having to build them from scratch.

APIs can be categorized into different types, including:

1. Web APIs:
a. These are APIs that enable communication
between web-based applications.
b. They are commonly used in web development
and allow developers to access services and data
over the internet using protocols such as HTTP.

2. Operating System APIs:

a. These APIs provide access to various functions
and services of an operating system.
b. They allow applications to interact with the
underlying hardware and perform tasks such as
file management, network communication, and
device control.

3. Library APIs:
a. Libraries provide a collection of pre-written code
and functions that developers can use in their
applications.
b. Library APIs define how to use the functions and
access the features provided by the library.
API
• APIs are typically documented with specifications
that describe the available endpoints, parameters,
data formats, authentication requirements, and
response structures.
• Developers use these specifications to understand
how to interact with the API and integrate it into their
own applications.
• APIs have become essential in modern software
development as they facilitate integration,
interoperability, and collaboration between different
applications and services.
• They enable developers to create more powerful and
feature-rich applications by leveraging the
functionalities and data of existing systems.

II. API Testing

• API testing is a type of software testing that focuses

on testing the application programming interfaces
(APIs) of a software system.
• It involves testing the communication between
different software components, ensuring that the APIs
function correctly, handle requests and responses
appropriately, and meet the required specifications.
• API testing is typically performed by sending requests
to the API endpoints and validating the responses
received.
• It is done independently of the user interface and
focuses on the backend functionality of the system.
API
Some key aspects of API testing include:

1. Request and Response Validation:

a. API testing verifies that the requests sent to the
API endpoints are properly formatted, contain
the required parameters, and adhere to the
specified data formats.
b. It also validates that the responses received from
the API meet the expected standards and provide
the correct data.

2. Functional Testing:
a. API testing verifies the functional behaviour of
the APIs, ensuring that they perform the
intended operations and produce the expected
results.
b. This includes testing various API methods,
parameters, error handling, authentication, and
authorization mechanisms.

3. Performance Testing:
a. API testing may also involve performance testing
to assess the responsiveness and scalability of
the APIs.
b. This includes measuring response times,
throughput, and resource utilization under
different load conditions.

4. Security Testing:
a. API testing includes security testing to identify
vulnerabilities, such as improper handling of
API
sensitive data, authentication weaknesses, or
inadequate access controls.

5. Integration Testing:
a. API testing focuses on testing the integration of
different software components through their
APIs.
b. It ensures that data is exchanged correctly,
dependencies are properly managed, and the
overall system functions as expected.

• API testing can be performed using various tools and

frameworks, including specialized API testing tools,
programming languages, and testing frameworks.
• These tools provide capabilities for creating test
scenarios, executing requests, validating responses,
and generating test reports.
• API testing is critical for ensuring the reliability,
functionality, and performance of software systems.
• It helps identify issues early in the development cycle,
supports continuous integration and deployment
processes, and facilitates the seamless integration of
different software components and services.

III. Role of A software tester in API testing

• The role of a software tester in API testing involves

various responsibilities to ensure the quality and
reliability of the API.
API
Here are some key roles and responsibilities of a
software tester in API testing:

1. Test Planning:
a. The tester is responsible for understanding the
API specifications, requirements, and testing
objectives.
b. They create a test plan that outlines the testing
approach, test cases, and test data required for
API testing.

2. Test Environment Setup:

a. The tester sets up the test environment, which
includes configuring the necessary tools,
frameworks, and test data.
b. They ensure that the testing environment is
stable and replicates the production environment
as closely as possible.

3. Test Case Design:

a. The tester designs test cases that cover various
functional scenarios, error conditions, and edge
cases of the API.
b. They define the input data, expected results, and
assertions to validate the API's behavior.

4. Test Execution:
a. The tester executes the test cases by sending
requests to the API endpoints and validating the
responses.
API
b. They may use API testing tools or programming
languages to automate the test execution process
for efficiency and accuracy.

5. Test Data Management:

a. The tester manages test data, which includes
creating and maintaining relevant test data sets.
b. They ensure that the test data covers different
scenarios and edge cases to validate the API's
behaviour.

6. Defect Reporting and Tracking:

a. When issues or defects are identified during
testing, the tester reports them in a clear and
detailed manner.
b. They work closely with the development team to
reproduce the issues, provide necessary logs or
evidence, and track the defect resolution process.

7. Performance Testing:
a. In some cases, the tester may be responsible for
performance testing of the API.
b. They design performance test scenarios, execute
load or stress tests, and analyze the performance
metrics to identify any performance bottlenecks
or issues.

8. Collaboration and Communication:

a. The tester collaborates with developers, business
analysts, and other stakeholders to clarify
requirements, address concerns, and ensure
API
effective communication throughout the testing
process.
b. They provide regular updates on the testing
progress and raise any concerns or risks related
to the API's quality.

9. Documentation:
a. The tester documents the test artifacts, including
test plans, test cases, and test results.
b. They may also contribute to the API
documentation by providing insights and
feedback based on their testing experience.

• Overall, the role of a software tester in API testing is

to ensure the API's functionality, reliability,
performance, and security by designing and executing
effective test strategies and providing valuable
feedback to improve the quality of the API.

IV. API Testing and Unit Testing.

• API testing and unit testing are two different types of

testing that serve different purposes in software
development.

Here's a comparison between API testing and unit testing:

1. API Testing:

a. API testing focuses on testing the functionality

and behavior of APIs (Application Programming
Interfaces).
API
b. It involves testing the interactions between
different software components, such as the
communication between client applications and
server APIs.
c. API testing verifies if the APIs meet the expected
functionality, response formats, error handling,
security, and performance requirements.
d. It can involve testing different types of APIs, such
as RESTful APIs, SOAP APIs, or other web
services.
e. API testing is typically performed at a higher
level of abstraction, focusing on the external
behavior and usage of the APIs.

2. Unit Testing:

a. Unit testing focuses on testing individual units of

code, typically at the class or method level.
b. It aims to validate the correctness of small,
isolated units of code independently.
c. Unit testing is often done by developers to ensure
that their code functions as expected and meets
the specified requirements.
d. It involves testing small chunks of code in
isolation, mocking or stubbing dependencies to
isolate the unit under test.
e. Unit tests are typically written using
programming languages and frameworks specific
to the application development stack.
API
Key Differences:

1. Scope:
a. API testing focuses on testing the behavior and
interactions of APIs, while unit testing focuses on
testing the correctness of individual units of
code.

2. Level of Abstraction:
a. API testing operates at a higher level of
abstraction, testing the external interfaces and
functionalities of APIs, while unit testing
operates at a lower level, testing the internals of
individual code units.

3. Responsibility:
a. API testing is often the responsibility of software
testers or QA engineers, while unit testing is
primarily the responsibility of developers.

4. Dependencies:
a. API testing typically involves testing the
integration and interaction between different
components, while unit testing aims to isolate
the code unit under test by mocking or stubbing
dependencies.

• In summary, API testing and unit testing are

complementary testing approaches that focus on
different levels of the software stack.
API
• API testing verifies the behaviour and functionality of
APIs, while unit testing validates the correctness of
individual units of code.
• Both types of testing are important in ensuring the
overall quality and reliability of a software
application.

3. Postman basics

Information

I. API Testing with Postman

• API testing with Postman is a widely used approach

for testing APIs. Postman is an API development and
testing tool that provides a user-friendly interface for
creating, sending, and validating API requests.

Here's an explanation of API testing with Postman:

1. Building Requests:

a. Postman allows you to create and configure

HTTP requests for various API endpoints.
b. You can specify the request method (GET, POST,
PUT, DELETE, etc.), URL, headers, request body,
and any required parameters.
c. You can easily add authentication credentials,
headers, query parameters, and request body
API
parameters to your API requests using Postman's
intuitive interface.

2. Organizing and Managing Requests:

a. Postman provides a workspace where you can

organize and manage your API requests.
b. You can create collections to group related
requests, add folders within collections for
further organization, and save your requests for
future use.
c. You can also add descriptions, tags, and
comments to make your requests more
descriptive and meaningful.

3. Executing Requests:

a. With Postman, you can send API requests and

receive responses directly within the tool.
b. It allows you to specify the request method, URL,
and other parameters, and then sends the
request to the API server.
c. Postman provides detailed response information,
including status codes, response headers, and
response body.
d. You can view the response in a formatted
manner, making it easier to analyze the API
response data.
API
4. Assertions and Validation:

a. Postman enables you to define assertions and

validation tests to verify the correctness of API
responses.
b. You can use assertions to check specific values in
the response body, headers, or status codes.
c. Postman provides various built-in assertions and
supports scripting using JavaScript, allowing you
to write custom validation scripts for complex
scenarios.

5. Test Automation and Collaboration:

a. Postman supports test automation, allowing you

to create test suites and run them as part of your
continuous integration and delivery pipelines.
b. It also enables collaboration among team
members by providing features like sharing
collections, collaborating on requests, and
documenting APIs.

• In summary, API testing with Postman simplifies the

process of testing and validating APIs.
• It provides a user-friendly interface for creating,
sending, and validating API requests, along with
features for organizing and managing requests,
executing requests, asserting and validating
responses, and supporting test automation and
collaboration.
API

II. Download and Install Postman

To download and install Postman, you can follow these

steps:

1. Visit the Postman website: Go to the official Postman

website at [Link]

2. Download the Postman application: On the Postman

website, click on the "Download" button. It will
automatically detect your operating system and
provide the appropriate download option.

3. Select the appropriate version: Choose the version

that is compatible with your operating system
(Windows, macOS, or Linux). Postman also offers a
Chrome extension if you prefer to use it within the
browser.

4. Install Postman: Once the download is complete, open

the installer file and follow the on-screen instructions
to install Postman on your machine. The installation
process is straightforward and should only take a few
minutes.

5. Launch Postman: After the installation is complete,

you can launch Postman by clicking on the application
icon.
API
• That's it! Postman is now installed on your computer,
and you can start using it for API testing and
development.
• Note: Postman also offers a web version that you can
use directly in your browser without the need for
installation.
• Simply visit the Postman website and click on the
"Launch Postman" button to access the web version.
• However, for more advanced features and capabilities,
it is recommended to install the desktop version of
Postman.

III. Postman Navigation

• Once you have installed Postman, you can navigate

through its various features and functionalities.

Here's a brief overview of the main sections and options in

Postman:

1. Workspace:
a. When you open Postman, you will see the
workspace dashboard.
b. You can create or select a workspace to organize
your API collections and collaborate with team
members.

2. Sidebar:
a. On the left-hand side, you'll find the sidebar with
several sections:
API
3. Collections:
a. This is where you can create and manage
collections of API requests.

4. Environments:
a. You can define environments to store variables
and values that can be used in requests.

5. History:
a. It keeps track of your previously sent requests
and their responses.

6. APIs:
a. Postman provides access to a directory of public
APIs that you can explore and use in your
projects.

7. Integrations:
a. This section allows you to integrate Postman
with various tools and services.

8. Workspace Navigation:
a. At the top of the sidebar, you can switch between
different workspaces if you have multiple
workspaces set up.

9. Request Builder:
a. In the main area of the Postman interface, you
can build your API requests.
b. This includes specifying the HTTP method (GET,
POST, PUT, DELETE, etc.), URL, headers, query
API
parameters, request body, and authentication
details.

10. Tabs:
a. Postman allows you to work with multiple
requests simultaneously by using tabs.
b. You can open multiple tabs and switch between
them to work on different requests.

11. Response Viewer:

a. Once you send a request, the response will be
displayed in the response viewer section.
b. You can view the response status, headers, body,
and other relevant details.

12. Tests and Pre-request Scripts:

a. Postman provides scripting capabilities to write
tests and pre-request scripts for your requests.
b. You can write JavaScript code to automate
validations, data manipulations, and more.

13. Collections Runner:

a. You can execute a collection of requests in a
sequence using the Collections Runner.
b. It allows you to run a series of API requests and
analyze the responses.

14. Documentation and Sharing:

a. Postman provides features to generate API
documentation and share your collections with
team members or external stakeholders.
API
• These are just the basic features and options available
in Postman.
• As you explore further, you'll discover more advanced
functionalities such as authentication, environment
variables, mocks, monitors, and more.
• Note: The exact layout and options in Postman may
vary slightly based on the version and updates.

IV. Create New Request in Postman

To create a new request in Postman, follow these steps:

1. Open Postman: Launch the Postman application on

your computer.

2. Select the Collection: In the left sidebar, choose the

collection where you want to add the request. If you
don't have a collection, you can create a new one by
clicking on the "New" button in the Collections
section.

3. Click on the "New" button: At the top-left corner of

the main window, you'll see a "New" button. Click on
it to create a new request.

4. Choose Request Method: Select the HTTP method

(GET, POST, PUT, DELETE, etc.) for your request from
the dropdown menu next to the URL field.

5. Enter Request URL: In the URL field, enter the

complete URL of the API endpoint you want to test.
API

6. Set Request Headers: If your API requires specific

headers, you can add them by clicking on the
"Headers" tab below the URL field. Provide the header
name and value, and click the "Save" button.

7. Define Request Body (if applicable): If your request

requires a request body, you can select the
appropriate option (e.g., form-data, x-www-form-
urlencoded, raw, etc.) and enter the necessary data.

8. Set Request Parameters (if applicable): If your request

requires query parameters, you can add them by
clicking on the "Params" tab below the URL field.
Enter the parameter name and value, and click the
"Save" button.

9. Click on "Send": Once you have set up the request

method, URL, headers, body, and parameters, you can
click the "Send" button to send the request to the API.

10. View Response: Postman will display the

response received from the API in the main window.
You can view the response status, headers, body, and
other relevant information.

11. Save the Request: To save the request in your

collection, click on the "Save" button at the top-right
corner of the main window. Give the request a
suitable name and choose the desired collection to
save it.
API
• That's it! You have successfully created a new request
in Postman.
• You can now continue building and testing your API
requests within Postman.

V. GET Request in Postman

To send a GET request in Postman, follow these steps:

1. Open Postman: Launch the Postman application on

your computer.

2. Select the Collection: In the left sidebar, choose the

collection where you want to add the request. If you
don't have a collection, you can create a new one by
clicking on the "New" button in the Collections
section.

3. Click on the "New" button: At the top-left corner of

the main window, click on the "New" button to create
a new request.

4. Choose the Request Method: From the dropdown

menu next to the URL field, select "GET" as the
request method.

5. Enter the Request URL: In the URL field, enter the

complete URL of the API endpoint you want to send
the GET request to.

6. Set Request Headers (if needed): If your API requires

specific headers, you can add them by clicking on the
API
"Headers" tab below the URL field. Provide the header
name and value, and click the "Save" button.

7. Click on the "Send" button: Once you have set up the

request method, URL, and headers, you can click on
the "Send" button to send the GET request.

8. View the Response: Postman will display the response

received from the API in the main window. You can
view the response status, headers, body, and other
relevant information.

• That's it! You have successfully sent a GET request in

Postman.
• You can view and analyze the response data to
validate the behavior of the API.

VI. Response in Postman

• In Postman, the response refers to the data received

from the server after sending a request.
• Once you send a request, Postman displays the
response in the main window.
• The response typically includes information such as
the response status code, headers, and response body.

Here's how the response is displayed in Postman:

1. Response Status: The response status code indicates

the status of the request. It is displayed at the top of
the response pane, along with the corresponding
API
status message. For example, a 200 status code
indicates a successful response.

2. Response Headers: Below the response status, you

can find the response headers. Headers provide
additional information about the response, such as
content type, date, and server details. The headers are
displayed in a tabular format with columns for the
header name and value.

3. Response Body: The response body contains the

actual data returned by the server. It could be in
various formats such as JSON, XML, HTML, or plain
text, depending on the API. The response body is
displayed in the body section of the response pane.

4. Response Time and Size: Postman also displays the

response time and size in the footer of the response
pane. The response time indicates how long it took for
the server to respond, while the size indicates the size
of the response data.

• You can use the response data to verify the

correctness of the API's behavior, check for errors or
exceptions, and extract specific values for further
testing or validation.
• Note: The response in Postman may include other
elements like cookies, tests, and authorization details,
depending on the specific usage and configurations in
your requests.
API
• Overall, the response in Postman provides valuable
information about the outcome of the request and
allows you to analyze and validate the API's behavior.

VII. Request Parameters in Postman

• In Postman, request parameters are used to send data

along with a request to an API.
• These parameters provide additional information
required by the API to process the request correctly.
• Depending on the API and its documentation, request
parameters can be sent in different ways, such as
query parameters, form data, or as part of the request
body.

Here's how you can specify request parameters in

Postman:

1. Query Parameters: Query parameters are commonly

used in GET requests to pass data in the URL. To add
query parameters in Postman, you can directly
append them to the URL in the request's URL field.
For example, to include a name parameter with a
value of "John" in the URL, you can use ?name=John.

2. Form Data: If the API requires sending data in the

form format, you can select the "form-data" option in
the request's body tab. Then, you can add key-value
pairs representing the form fields and their respective
values. Postman will include this data in the request
body when you send the request.
API
3. Request Body: For requests that require sending
complex data or payloads, you can use the request
body. Postman supports different formats for the
request body, such as JSON, XML, and plain text. You
can select the appropriate format and enter the data
in the request body section.

4. Headers: In some cases, request parameters may need

to be sent as part of the headers. Postman allows you
to add custom headers to the request, where you can
specify the parameter name and its value.

• Remember to refer to the API documentation or the

specific requirements of the API you're working with
to determine the correct way to include request
parameters.

VIII. POST Request using Postman

To send a POST request using Postman, you can follow

these steps:

1. Open Postman and create a new request by selecting

the desired HTTP method (in this case, POST) from
the dropdown menu next to the URL field.

2. Enter the URL of the API endpoint you want to send

the POST request to in the URL field.
API
3. Specify the request body by selecting the appropriate
format (such as JSON, form-data, or raw) from the
tabs below the URL field.

4. For JSON: Select the "Body" tab, choose the "raw"

option, and set the content type to "application/json".
Then, enter the JSON data in the request body.

5. For form-data: Select the "Body" tab, choose the

"form-data" option, and add the key-value pairs
representing the form fields and their values.

6. For raw data: Select the "Body" tab, choose the "raw"
option, and set the content type according to the type
of data you're sending (e.g., text/plain,
application/xml).

7. If required, add any necessary headers by selecting

the "Headers" tab and entering the key-value pairs
representing the headers.

8. Click the "Send" button to send the POST request.

Postman will display the response received from the
server.

• Note: Ensure that you have the correct URL, request

body, and headers according to the API
documentation or requirements.
• Remember to adjust the request method, URL,
request body, and headers based on the specific API
you are working with.
API
4. Postman advanced topics

Information

I. Basic Authentication in Postman

To perform Basic Authentication in Postman, you can

follow these steps:

1. Open Postman and create a new request by selecting

the desired HTTP method from the dropdown menu
next to the URL field.

2. Enter the URL of the API endpoint you want to send

the request to in the URL field.

3. Click on the "Authorization" tab below the URL field.

4. In the "Type" dropdown, select "Basic Auth".

5. Enter the username and password in the respective

fields.

6. Click the "Preview Request" button to ensure that the

authentication details are included in the request
headers.

7. Click the "Send" button to send the request. Postman

will include the Basic Authentication headers in the
request.
API
• Note: Make sure to replace the placeholder values
with the actual username and password for the Basic
Authentication.
• With Basic Authentication, the username and
password are sent in the "Authorization" header of the
request using a Base64-encoded value.
• This allows the server to authenticate the user before
processing the request.

II. Environment Variables in Postman

• Environment variables in Postman allow you to define

and manage dynamic values that can be used across
multiple requests and collections.
• They provide a convenient way to store and reuse
values such as URLs, authentication tokens, or any
other variable that might change based on the
environment.

Here's an explanation of how to use environment variables

in Postman:

1. Create an environment: In Postman, click on the

"Manage Environments" button (eye icon) in the top-
right corner. Then click on "Add" to create a new
environment. Give it a name and add the variables you
want to define.

2. Define variables: Within the environment, you can

define variables by providing a key-value pair. For
example, you can set a variable called "baseURL" with
API
a value of "[Link] You can define
multiple variables as needed.

3. Use variables in requests: In your requests, you can

reference the environment variables by using the
syntax {{variable_name}}. For example, to use the
"baseURL" variable in a request URL, you can specify
it as {{baseURL}}/users.

4. Switch between environments: You can easily switch

between different environments by selecting the
desired environment from the dropdown menu in the
top-right corner of the Postman interface. This allows
you to switch between different sets of variables
depending on the environment (e.g., development,
testing, production).

• By utilizing environment variables, you can easily

manage and update values across multiple requests
and collections without needing to modify each
individual request.
• This provides flexibility and reusability in your API
testing workflow.

Example:
• Let's say you have defined an environment variable
called "baseURL" with a value of
"[Link]
• In a request, you can use this variable to construct the
request URL as follows:

GET {{baseURL}}/users
API

• When you send this request, Postman will replace

{{baseURL}} with the actual value defined in the
environment, resulting in a request to
"[Link]
• This allows you to easily switch the base URL by
changing the value of the "baseURL" variable in the
environment.

III. Collections In Postman

• Collections in Postman are a way to organize and

group related API requests, making it easier to
manage and execute them as a cohesive unit.
• A collection can contain multiple requests along with
additional features such as folders, variables, and
tests.

Here's an explanation of collections in Postman:

1. Creating a Collection: To create a collection, click on

the "New" button in the top-left corner of the
Postman interface and select "Collection". Give the
collection a name and any other optional details.

2. Adding Requests: Within a collection, you can add

multiple requests by clicking on the "+" button next to
the collection name. Provide a name for the request,
specify the HTTP method (GET, POST, PUT, DELETE,
etc.), and enter the request URL.
API
3. Organizing with Folders: You can create folders within
a collection to further organize your requests. Folders
can be used to group related requests together. To
create a folder, right-click on the collection and select
"Add Folder". Give the folder a name and move the
relevant requests into it.

4. Variables: Collections allow you to define variables

that can be used across multiple requests within the
collection. These variables can be used to store values
like access tokens, IDs, or any other dynamic data.
Variables make it easier to manage and update
common values across requests.

5. Tests and Pre-Request Scripts: Postman allows you to

write tests and pre-request scripts for each request in
a collection. These scripts can be written in JavaScript
and are executed before or after a request is sent.
They can be used to validate response data, extract
values, or set up environment variables.

6. Running and Sharing Collections: Once you have

created a collection, you can run it by clicking on the
"Run" button. This will execute all the requests in the
collection in the defined order. You can also export
collections to share them with teammates or import
collections shared by others.

Example:
• Let's say you have a collection called "User API"
containing multiple requests such as "Get All Users",
"Create User", and "Delete User".
API
• You can organize these requests into folders like “User
Management” and “User Authentication” based on
their functionality.
• Within each request, you can define tests to validate
the response data and set environment variables for
storing access tokens or user IDs.
• You can then run the entire collection to execute all
the requests and verify their functionality.
• Collections in Postman provide a structured way to
organize and manage your API requests, making it
easier to work with multiple APIs, share them with
teammates, and automate testing workflows.

V. Test and Collection Runner in Postman

• In Postman, the Test Runner and Collection Runner

are two powerful features that allow you to automate
and execute tests on your API requests and
collections.

Here's an explanation of both:

1. Test Runner:
a. The Test Runner in Postman allows you to define
and run tests for individual API requests.
b. It is useful for testing and verifying the
functionality of a single request. Here's how it
works:

2. Writing Tests:
a. Within each API request, you can write tests
using JavaScript syntax.
API
b. These tests can validate the response status code,
response body, headers, and more.
c. Tests can be written in the "Tests" tab of the
request editor using the Postman Sandbox.

3. Executing Tests:
a. Once you have written the tests, you can run
them using the Test Runner.
b. Click on the "Send" button to send the request
and the Test Runner will execute the tests and
display the results.
c. You can see the test results in the "Test Results"
pane below the request editor.

4. Viewing Test Results:

a. The Test Runner displays the test results as
passed or failed along with any error messages
or assertions.
b. It provides detailed information about the tests
executed and helps in identifying any issues or
failures in the API response.

5. Collection Runner:
a. The Collection Runner is a feature in Postman
that allows you to run a collection of API requests
as a series of tests.
b. It is useful when you want to execute multiple
requests and perform end-to-end testing of your
API endpoints.

Here's how it works:

1. Selecting a Collection:
API
a. To use the Collection Runner, you need to have a
collection created with multiple requests.
b. Open the collection and click on the "Runner"
button in the top-right corner.

2. Configuring Execution:
a. In the Collection Runner, you can configure the
execution settings such as the number of
iterations, delay between requests, and data files
if you are using data-driven testing.

3. Executing the Collection:

a. Once you have configured the settings, click on
the "Start Run" button to begin executing the
collection.
b. The Collection Runner will run each request in
the collection one by one and display the results.

4. Viewing Collection Run Results:

a. After the execution, the Collection Runner
provides a summary of the test run, including the
number of requests executed, the pass/fail status
of each request, and any errors or failures
encountered.
b. You can also view detailed logs and reports for
each individual request.

Example:
• Let's say you have a collection called "User API" with
requests like "Get All Users", "Create User", and
"Delete User".
API
• In the Test Runner, you can write tests for each
request to verify the expected response.
• For example, you can check if the "Get All Users"
request returns a successful status code and the
response contains the expected user data.
• In the Collection Runner, you can configure the
collection execution settings, such as the number of
iterations and delay between requests.
• You can then start the run, and Postman will execute
each request in the collection, running the defined
tests for each request.
• The Collection Runner will provide you with detailed
results, including the pass/fail status of each request
and any assertions that failed.
• The Test Runner and Collection Runner in Postman
help streamline and automate the testing process,
allowing you to run tests on individual requests or
execute a series of requests as part of a collection.
• They provide valuable insights into the functionality
and performance of your APIs.

VI. Monitor Collections

• In Postman, the Monitor feature allows you to

schedule and run your collections periodically,
helping you automate the testing and monitoring of
your APIs.

Here's an explanation of how Monitor works:

API
1. Creating a Monitor:
a. To create a Monitor, you need to have a collection
with the requests you want to monitor.
b. Open the collection and click on the "Monitor"
button in the top-right corner. This will open the
Monitor creation page.

2. Configuring Monitor Settings:

a. In the Monitor creation page, you can configure
various settings for your Monitor. These include:

3. Schedule:
a. Set the frequency at which the collection should
be run, such as every few minutes, hourly, or
daily.

4. Environment:
a. Choose the environment variables to use during
the Monitor run.

5. Data:
a. If you have data files associated with your
requests, you can upload them to be used during
the Monitor run.

6. Assertions:
a. Define assertions to validate the responses
received during the Monitor run.

7. Notifications:
API
a. Specify the recipients and notification
preferences for any alerts or failures during the
Monitor run.

8. Starting the Monitor:

a. After configuring the Monitor settings, click on
the "Start Monitor" button to initiate the
monitoring process.
b. Postman will run the collection based on the
defined schedule.

9. Monitoring Results:
a. During the Monitor run, Postman will send
requests to the specified endpoints and collect
the responses.
b. It will validate the responses against the defined
assertions.
c. Any failures or errors will be logged and can be
viewed in the Monitor dashboard.

10. Monitor Dashboard:

a. The Monitor dashboard provides a
comprehensive view of the Monitor runs.
b. It displays the status of each run, including the
pass/fail status, average response times, and any
errors encountered.
c. You can view detailed logs and reports for each
individual run, helping you identify issues and
troubleshoot.

Example:
API
• Let's say you have a collection called "User API" with
requests like "Get All Users" and "Create User".
• You want to monitor these endpoints periodically to
ensure they are functioning correctly.
• You can create a Monitor for the "User API" collection
with a schedule of every 30 minutes.
• During the Monitor run, Postman will execute the "Get
All Users" and "Create User" requests every 30
minutes.
• It will validate the responses received against the
defined assertions, such as checking for a successful
status code and the presence of expected data.
• Any failures or errors encountered during the
Monitor run will be recorded in the Monitor
dashboard.
• The Monitor dashboard provides a centralized
location to view the results of the Monitor runs,
including the pass/fail status of each run and any
errors or failures encountered.
• This allows you to track the performance and
functionality of your APIs over time and take
appropriate actions if any issues arise.
• Monitoring collections in Postman helps you ensure
the reliability and availability of your APIs by
automating the testing and monitoring process,
making it easier to identify and resolve any issues that
may arise.

VII. Workflows in Postman

API
• In Postman, workflows allow you to define and
automate complex sequences of requests and tests.
• Workflows help you streamline and optimize your
API testing and collaboration efforts.

Here's an explanation of how workflows work in Postman:

1. Creating a Workflow:
To create a workflow in Postman, you need to have a
collection with the requests you want to include in the
workflow. Open the collection and click on the "Add to
Workflow" button next to each request you want to
include. This will add the requests to the workflow
canvas.

2. Defining Workflow Sequence:

In the workflow canvas, you can arrange the requests in
the desired sequence by dragging and dropping them.
You can also add control flow elements like loops,
conditions, and delays to customize the execution flow
of the workflow.

3. Adding Tests and Assertions:

For each request in the workflow, you can define tests
and assertions to validate the responses. This allows you
to verify that the API is behaving as expected at each
step of the workflow. You can use the built-in testing
capabilities of Postman, such as writing JavaScript-
based tests or using predefined assertions.

4. Managing Variables and Environments:

API
Workflows in Postman allow you to manage variables
and environments effectively. You can define and use
variables across requests in the workflow, allowing you
to reuse and share data between requests. You can also
switch between different environments to test your APIs
in different settings.

5. Running the Workflow:

Once you have defined the workflow, you can run it by
clicking the "Run" button in the workflow canvas.
Postman will execute the requests in the defined
sequence and validate the responses based on the
specified tests and assertions. You can view the results
of each request and any failures or errors encountered.

Example:
• Let's say you have a collection called "User
Management API" with requests like "Create User",
"Get User Details", and "Update User".
• You want to create a workflow to automate the
process of creating a user, retrieving their details,
and updating their information.
• You can start by adding the "Create User" request to
the workflow canvas.
• Then, add the "Get User Details" request and
connect it to the "Create User" request.
• Finally, add the "Update User" request and connect
it to the "Get User Details" request.
• In each request, you can define tests and assertions
to ensure that the API is working correctly.
• For example, you can check if the user was created
successfully, if the user details are retrieved
API
correctly, and if the user information is updated as
expected.
• Once the workflow is set up, you can run it by
clicking the "Run" button.
• Postman will execute the requests in the defined
sequence and validate the responses based on the
specified tests.
• You can view the results of each request and
quickly identify any failures or errors.
• Workflows in Postman provide a visual and
organized way to define and execute complex API
testing scenarios.
• They allow you to automate and streamline your
testing process, making it easier to manage and
collaborate on API testing efforts.

VIII. Pre-Request Script in Postman

• In Postman, a Pre-Request Script is a script that is

executed before sending a request.
• It allows you to dynamically modify the request
parameters, headers, or body based on certain
conditions or values.

Here's an explanation of how Pre-Request Scripts work in

Postman:

1. Purpose of Pre-Request Script:

The Pre-Request Script is used to perform any necessary
setup or modifications before sending the request. It can
be used to generate dynamic values, set authentication
API
headers, compute checksums, or any other operations
required to prepare the request.

2. Accessing Request Details:

In the Pre-Request Script, you have access to the request
object, which provides information about the request
being sent. You can access details such as the request
URL, method, headers, body, and parameters.

3. Writing JavaScript Code:

The Pre-Request Script is written in JavaScript. You can
leverage the power of JavaScript to perform various
operations and logic. Postman provides a built-in code
editor where you can write and test your script.

4. Modifying Request Properties:

You can use the Pre-Request Script to modify any
property of the request object. For example, you can add
or remove headers, update the request body, or
manipulate the request URL. You can also set
environment or global variables based on the response
of previous requests.

5. Using Variables:
The Pre-Request Script can access and manipulate
variables defined in Postman, such as global variables,
environment variables, or collection variables. This
allows you to use dynamic values in your requests and
update variables as needed.

Example:
API
• Let's say you have an API endpoint that requires
authentication using a token.
• In your Pre-Request Script, you can add the
necessary authentication headers before sending
the request.

Here's an example script:

// Retrieve the authentication token from an environment variable

const authToken = [Link]('authToken');

// Add the authentication header to the request

[Link]({
key: 'Authorization',
value: `Bearer ${authToken}`
});

• In this example, the script retrieves the authentication

token from the environment variable authToken.
• It then adds the Authorization header to the request,
using the retrieved token.
• The Pre-Request Script allows you to dynamically
modify the request based on specific conditions or
values.
• It provides flexibility and customization options to
handle various scenarios in your API testing.

IX. Assertions in Postman with Chai Assertion Library

• In Postman, you can use assertions to validate the

response of an API request.
API
• Assertions allow you to specify expected values or
conditions and check if the actual response matches
those expectations.
• Chai Assertion Library is a popular assertion library
that can be used in Postman for more advanced
assertion capabilities.

Here's an explanation of how assertions with Chai

Assertion Library work in Postman:

1. Purpose of Assertions:
Assertions are used to verify the correctness of the
response received from an API request. They help ensure
that the API is behaving as expected and meeting the
desired criteria. Assertions are typically used to validate
response status codes, response body content, headers, or
any other aspect of the response.

2. Using Chai Assertion Library:

Chai Assertion Library provides a rich set of assertion
methods that can be used to perform various types of
validations. It supports different assertion styles, such as
should, expect, and assert, allowing you to choose a style
that suits your preference. Chai provides a wide range of
assertion methods, including equality checks, type checks,
existence checks, and more.

3. Writing Assertions in Postman:

To use Chai Assertion Library in Postman, you need to
write assertions in the Postman test scripts using the
JavaScript syntax. You can access the response object and
use Chai assertion methods to validate specific properties
API
or values within the response. For example, you can check
if a certain field exists, validate the value of a specific
property, or assert on the length of an array.

Example:
• Let's say you have an API endpoint that returns a
JSON response containing user information.
• You can write assertions using Chai Assertion Library
to validate the response.

Here's an example script:

// Parse the response body as JSON

const responseBody = [Link](responseBody);

// Use Chai assertion to validate response properties

[Link]('name').equal('John Doe');
[Link]('age').above(18);
[Link]('email').[Link]('@');

• In this example, the script parses the response body

as JSON and then uses Chai assertion methods
(should) to validate the presence and values of
specific properties in the response.
• It checks if the name property is equal to "John Doe",
if the age property is greater than 18, and if the email
property contains the @ symbol.
• Using Chai Assertion Library in Postman allows you to
write more expressive and powerful assertions for
your API testing.
API
• It provides a comprehensive set of assertion methods
to handle various validation scenarios and ensure the
correctness of your API responses.

X. Different types of Asserts in Postman

• In Postman, there are different types of asserts that

you can use to validate the responses of API requests.
• These asserts help you ensure that the response
meets the expected criteria.

Here are some of the commonly used assert types in

Postman:

1. Status Code Asserts:

Status code asserts are used to validate the HTTP status
code returned by the API request. You can check if the
status code matches the expected value or falls within a
specific range. For example:

[Link](200); // Asserts that the status code is

200
[Link]; // Asserts that the status code is in the
2xx range

2. Response Body Asserts:

Response body asserts allow you to validate the content of
the response body. You can check if a specific property
exists, has a certain value, or matches a regular expression.
For example:
API

[Link]('name'); // Asserts that the response

body contains the 'name' property
[Link]('age', 25); // Asserts that the 'age'
property is equal to 25
[Link]('email', /@example\.com$/); //
Asserts that the 'email' property matches the specified regex pattern

3. Header Asserts:
Header asserts are used to validate the headers in the API
response. You can check if a specific header exists, has a
certain value, or matches a regular expression.

For example:

[Link]('Content-Type'); // Asserts that the

response has a 'Content-Type' header
[Link]('Content-
Type').includes('application/json'); // Asserts that the 'Content-Type'
header contains 'application/json'

4. Time Asserts:
Time asserts are used to measure the response time of the
API request and validate if it falls within a certain range.
You can check if the response time is less than or equal to a
specific value.

For example:

[Link]([Link]).[Link](500); // Asserts
that the response time is less than 500 milliseconds
API
• These are just a few examples of the different types of
asserts available in Postman.
• Depending on your testing requirements, you can use
a combination of these asserts to thoroughly validate
the responses of your API requests.

XI. What is a Cookie?

• A cookie is a small piece of data that is stored on the

client-side (user's device) by a web server.
• It is used to store information about the user or their
interaction with a website.
• Cookies are sent by the server to the browser as part
of the HTTP response, and the browser stores them
locally.
• On subsequent requests to the same website, the
browser sends the stored cookies back to the server
as part of the HTTP request.

Cookies have several uses in web applications, including:

1. Session Management: Cookies are commonly used to

manage user sessions. When a user logs into a
website, a session cookie is created and stored on
their device. This cookie is used to identify the user
during their session and maintain their
authentication state.

2. Personalization: Cookies can be used to remember

user preferences and personalize the website
experience. For example, a website may store a user's
API
preferred language, theme, or layout settings in a
cookie.

3. Tracking and Analytics: Cookies can be used to track

user behavior and gather analytics data. Website
owners can use cookies to collect information about
page views, clicks, and other actions performed by
users. This data can be used for analyzing user
behavior, improving website performance, and
delivering targeted advertisements.

4. Shopping Carts and E-commerce: Cookies are often

used to store information about items added to a
shopping cart. This allows users to continue shopping
and maintain their selected items even if they
navigate away from the page.

• Cookies have certain properties, including a name,

value, expiration date, domain, and path.
• The name and value pair is typically used to store
specific information.
• The expiration date determines how long the cookie
will be stored on the user's device.
• The domain and path specify the scope of the cookie
and determine on which pages it will be sent to the
server.
• It's important to note that cookies can contain
sensitive information, so their usage should be
handled carefully.
• Web developers should ensure that cookies are used
in compliance with privacy regulations and best
practices to protect user data.
API

XII. Cookies in Postman

• In Postman, you can work with cookies using the

built-in Cookie Manager.
• The Cookie Manager allows you to view, add, edit, and
delete cookies for a specific domain.

Here’s how you can work with cookies in Postman:

1. Open Postman and make a request to a website that

sets cookies in the response.

2. After receiving the response, go to the “Cookies” tab

located below the response body.

3. In the Cookies tab, you will see a list of cookies set by

the server. Each cookie will have properties such as
Name, Value, Domain, Path, Expires, and Secure.

4. To add a new cookie, click on the “Add Cookie” button.

Enter the Name, Value, and optionally set the Domain,
Path, Expires, and Secure values. Click “Save” to add
the cookie.

5. To edit an existing cookie, click on the cookie in the

list and update the properties in the right-hand panel.
Click “Save” to apply the changes.
API

6. To delete a cookie, click on the cookie in the list and

then click the “Delete” button.

7. You can also use the Postman scripting feature to

manipulate cookies programmatically. For example,
you can extract the value of a cookie from a response
and store it in a Postman environment variable for
future requests.

• Working with cookies in Postman allows you to

simulate and test scenarios involving cookies in your
API requests.
• It helps you manage and manipulate cookies to
validate the behavior of your API endpoints that rely
on cookies for authentication, session management,
or other functionalities.

XIII. Share Session ID Cookies in Postman

To share session ID cookies in Postman, you can follow

these steps:

1. Obtain the session ID cookie: Make a request to the

authentication endpoint or login endpoint of your
application using Postman. In the response headers,
look for the "Set-Cookie" header that contains the
session ID cookie. Note down the name and value of
the session ID cookie.
API

2. Set the session ID cookie in Postman: Open the

request that requires the session ID cookie in
Postman. Go to the "Headers" tab and add a new
header with the name "Cookie" and the value in the
format "cookieName=cookieValue". Replace
"cookieName" with the actual name of the session ID
cookie and "cookieValue" with the corresponding
value.

3. Share the collection or environment: To share the

request along with the session ID cookie, you can save
the request in a collection or environment. Collections
and environments can be exported and shared with
others. When the recipient imports the collection or
environment, the session ID cookie will be included.

• Note: When sharing the session ID cookie, be cautious

about the security implications. Session ID cookies
are sensitive information and should be handled
securely. Make sure to share the collection or
environment only with trusted individuals and ensure
that the session ID cookie is protected and used
appropriately.

• By sharing the session ID cookie in Postman, you can

collaborate with others or transfer requests with the
necessary authentication context to perform API
testing or demonstration activities.

XIV. Sessions In Postman

API
• In Postman, sessions refer to the ability to maintain
state or context between multiple requests.
• By using sessions, you can store and reuse data across
requests, such as authentication tokens, cookies, or
variables.

Here's how you can work with sessions in Postman:

1. Start a session: To start a session, you can either make

a request that returns session-related information
(e.g., authentication) or manually set session-related
data (e.g., cookies, tokens) in the request.

2. Store session data: After obtaining session-related

data, you can store it in Postman using variables or
environments. Variables allow you to store and access
data within a single collection or request, while
environments allow you to store and access data
across multiple requests or collections.

3. Reuse session data: Once session data is stored, you

can reuse it in subsequent requests. For example, you
can use variables or environment references to
dynamically populate headers, body parameters, or
URL parameters with the session-related data.

4. Update session data: If the session data changes

during the course of your testing or API interactions,
you can update the stored data in variables or
environments. This ensures that the subsequent
requests reflect the updated session state.
API
• By effectively using sessions in Postman, you can
streamline your API testing workflows, automate
repetitive tasks, and maintain the necessary context
or state between requests.

XV. OAuth 2.0 Authorization

• OAuth 2.0 is an authorization framework that allows

third-party applications to access protected resources
on behalf of a user.
• It provides a secure and standardized way to
authorize access to APIs.

1. OAuth 2.0 involves multiple parties: the client

application (which wants to access the protected
resources), the resource server (which hosts the
protected resources), and the authorization server
(which grants access tokens to the client application).

Here's a brief overview of the OAuth 2.0 authorization

flow:

1. Client registration: The client application needs to

register itself with the authorization server and
obtain client credentials (client ID and client secret).
These credentials are used to authenticate the client
when requesting access tokens.

2. Authorization request: The client initiates the

authorization process by redirecting the user to the
authorization server. This request includes details
such as the requested scope of access and a redirect
API
URL where the user will be redirected after
authentication.

3. User authentication and consent: The user is

redirected to the authorization server's
authentication page, where they enter their
credentials and grant consent to the client application
to access their resources.

4. Authorization code grant: After successful

authentication and consent, the authorization server
generates an authorization code and redirects the
user back to the client application's redirect URL.

5. Access token request: The client application uses the

authorization code to request an access token from
the authorization server. This request includes the
client credentials, the authorization code, and the
redirect URL.

6. Access token response: The authorization server

validates the request and, if valid, issues an access
token to the client application. The access token
represents the authorization granted to the client
application to access protected resources.

7. Accessing protected resources: The client application

includes the access token in subsequent API requests
as an authorization header or a query parameter. The
resource server validates the access token and allows
or denies access to the requested resources based on
the token's validity and the requested scope of access.
API

• OAuth 2.0 provides a flexible and secure way to

authorize access to APIs without exposing the user's
credentials to the client application.
• It is widely used by many popular web services and
APIs, including social media platforms and cloud
service providers.

XVI. OAuth 2.0 Authorization with Postman

• In Postman, you can easily perform OAuth 2.0

authorization flows to obtain access tokens and make
authenticated API requests.

Here's how you can configure OAuth 2.0 authorization in

Postman:

1. Create a new request or open an existing request in

Postman.

2. In the request builder, navigate to the "Authorization"

tab.

3. Select the "OAuth 2.0" type from the "Type"

dropdown menu.

4. Click on the "Get New Access Token" button.

5. In the "Get New Access Token" dialog, enter the

following details:
API
a. Token Name: Provide a name for the access
token.
b. Grant Type: Select the appropriate grant type
based on the authorization flow you want to use
(e.g., Authorization Code, Implicit, Client
Credentials, etc.).
c. Callback URL: Specify the callback URL where the
authorization server will redirect the user after
authentication (if applicable).
d. Auth URL: Enter the URL of the authorization
server's authentication endpoint.
e. Access Token URL: Enter the URL of the
authorization server's access token endpoint.
f. Client ID: Provide the client ID associated with
your application.
g. Client Secret: Enter the client secret associated
with your application (if applicable).
h. Scope: Specify the desired scope of access.
6. Click on the "Request Token" button. Postman will
open a new tab or window where you will be
prompted to authenticate with the authorization
server and grant consent for the requested scopes.

7. After successful authentication and consent, the

authorization server will redirect you back to
Postman with an access token.

8. Postman will automatically populate the access token

in the request's authorization header. You can also
view the access token and its details in the "Token"
tab of the "Get New Access Token" dialog.
API
9. You can now use the access token to make
authenticated API requests. Postman will include the
access token in the request headers for you.

• Note: The exact steps and options may vary

depending on the OAuth 2.0 provider you are using.
Make sure to refer to the documentation or guidelines
provided by your authorization server for specific
configuration details.
• By configuring OAuth 2.0 authorization in Postman,
you can simplify the process of obtaining access
tokens and testing API endpoints that require
authentication.

5. Postman newman

Information

I. What is Newman in Postman?

• Newman is a command-line tool for running Postman

collections.
• It allows you to execute Postman collections and
environments without using the Postman app or the
Postman API.
• Newman is particularly useful for automating API
testing and integrating it into your continuous
integration (CI) or continuous delivery (CD) pipeline.
• With Newman, you can run your Postman collections
in a command-line environment, which makes it
API
easier to integrate with build systems, version control
systems, and other testing frameworks.
• It provides a way to execute collections in an
automated and scripted manner, allowing you to
incorporate API testing into your existing workflows.

Here are some key features and benefits of using Newman:

1. Command-line execution: Newman runs Postman

collections from the command line, allowing for
seamless integration with CI/CD tools and
automation scripts.

2. Collection execution: Newman can execute entire

collections or specific folders and test scripts within a
collection.

3. Environment support: Newman supports the use of

Postman environments, allowing you to dynamically
manage variables and configurations during the test
execution.

4. Output formats: Newman provides various output

formats, such as JSON and HTML, to generate detailed
test reports and logs.

5. Continuous integration: By incorporating Newman

into your CI/CD pipeline, you can automate the
execution of API tests whenever there are code
changes or deployments.
API
• Overall, Newman enhances the flexibility and
automation capabilities of Postman by enabling you to
run collections from the command line.
• It simplifies the process of executing tests and
integrating API testing into your software
development lifecycle.

II. Install Newman using NPM

• To install Newman using npm (Node Package

Manager), follow these steps:
• Ensure you have [Link] and npm installed on your
system.
• You can check if they are installed by running the
following commands in your terminal or command
prompt:

node -v
npm -v

• If [Link] and npm are not installed, you can

download and install them from the official [Link]
website ([Link]
• Once you have [Link] and npm installed, open your
terminal or command prompt.
• To install Newman globally on your system, use the
following command:

npm install -g newman

API

• This command will install Newman as a global

package, allowing you to access it from any directory.
• Wait for the installation process to complete.
• Once it's done, you can verify that Newman is
installed by running the following command:

newman --version

• This command will display the installed version of

Newman.
• That's it! You have successfully installed Newman
using npm.
• You can now use the newman command to run
Postman collections from the command line.

III. Running Collection Using Newman

To run a Postman collection using Newman, follow these

steps:

1. Make sure you have Newman installed on your

system. If not, you can install it using the instructions
provided earlier.

2. Export your Postman collection as a JSON file. In the

Postman app, select the collection you want to run,
click on the "..." (three dots) button, and choose
"Export". Save the collection as a JSON file.

3. Open your terminal or command prompt.

API

4. Navigate to the directory where your Postman

collection JSON file is located.

5. Run the following command to execute the collection

using Newman:

newman run <[Link]>

• Replace <[Link]> with the actual filename

of your Postman collection JSON file.
• Newman will start running the collection and display
the results in the terminal or command prompt.
• It will execute each request in the collection and show
the response status and other relevant details.
• That's it! You have successfully run a Postman
collection using Newman.
• Newman provides additional options and features for
running collections, such as specifying environment
variables, generating reports, and running collections
in parallel.
• You can refer to the Newman documentation for more
information on advanced usage and customization.

6. REST assured basics

Information
API
I. What is REST?

• REST stands for Representational State Transfer. It is

an architectural style used for designing networked
applications, particularly web services.
• REST is based on a set of principles and constraints
that allow systems to communicate over the internet
using standard protocols.
• In a RESTful architecture, resources are identified by
unique URIs (Uniform Resource Identifiers) and are
manipulated using standard HTTP methods such as
GET, POST, PUT, and DELETE.
• The communication between client and server is
stateless, meaning that each request from the client to
the server contains all the necessary information for
the server to understand and process the request.
• The server, in turn, sends back a response containing
the requested data or the result of the operation.

Some key characteristics of RESTful systems include:

1. Stateless: Each request from the client to the server is

self-contained and does not rely on any previous
interactions.

2. Client-Server Architecture: The client and server are

separate entities that communicate over a network.
The client is responsible for making requests, and the
server is responsible for processing those requests
and sending back responses.
API
3. Uniform Interface: RESTful systems use a uniform set
of well-defined methods (GET, POST, PUT, DELETE)
and standard protocols (HTTP) to interact with
resources.

4. Resource-Oriented: Resources are at the heart of

REST, and they are identified by unique URIs. Clients
interact with resources by sending requests to their
corresponding URIs.

5. State Transfer: The server transfers the state of a

resource to the client through representations (e.g.,
JSON or XML). The client can modify the state of the
resource by sending appropriate requests.

• REST has become a popular approach for building

web services due to its simplicity, scalability, and
compatibility with various platforms and
technologies.
• It allows for the development of loosely coupled,
interoperable systems that can be easily extended and
integrated with other applications.

II. Rest Architectural Elements

• The REST architectural style is based on several key

elements that define its principles and constraints.
These elements include:

1. Resources: Resources are the key concept in REST.

They represent any entity or object that can be
accessed or manipulated. Resources are identified by
API
unique URIs (Uniform Resource Identifiers), and each
resource has its own URI. For example, in a blog
application, a resource could be a blog post or a user
profile.

2. URIs (Uniform Resource Identifiers): URIs are used to

uniquely identify resources. They provide a way for
clients to locate and interact with specific resources.
URIs follow a hierarchical structure and can include
additional path segments and query parameters to
specify different aspects of the resource.

3. HTTP Methods: RESTful systems use standard HTTP

methods to perform operations on resources. The
most commonly used methods are:

a. GET: Retrieves the representation of a resource.

b. POST: Creates a new resource.
c. PUT: Updates an existing resource or creates a
new resource at a specific URI.
d. DELETE: Deletes a resource.
e. PATCH: Partially updates a resource.
4. Representations: Resources are represented in
different formats such as JSON (JavaScript Object
Notation) or XML (eXtensible Markup Language).
Clients and servers communicate by exchanging
representations of resources. The format of the
representation is determined by the client's request
and the server's response.

5. Statelessness: REST is stateless, which means that

each request from the client to the server must
API
contain all the necessary information for the server to
understand and process the request. The server does
not maintain any client-specific state between
requests. This allows for better scalability and
simplifies the architecture.

6. Hypermedia: Hypermedia, often referred to as

HATEOAS (Hypermedia as the Engine of Application
State), allows the server to provide links or references
to related resources in the response. Clients can
navigate through the application by following these
links, making the system more dynamic and flexible.

• These elements work together to create a scalable

and interoperable architecture for building
distributed systems.
• By adhering to these principles, RESTful systems can
be easily understood, extended, and integrated with
other applications.

III. Configure Eclipse with Rest-Assured

To configure Eclipse with Rest-Assured, follow these steps:

1. Install Eclipse: Download and install the Eclipse IDE

for Java Developers from the official Eclipse website
([Link] Choose the
appropriate version based on your operating system.

2. Create a new Java project: Open Eclipse and create a

new Java project by clicking on "File" -> "New" ->
API
"Java Project". Provide a name for the project and
click "Finish".

3. Add Rest-Assured dependency: Right-click on the

project in the Package Explorer and select
"Properties". In the Properties window, navigate to
"Java Build Path" -> "Libraries" tab. Click on "Add
External JARs" and select the Rest-Assured JAR file
that you have downloaded (can be obtained from
Maven repository or Rest-Assured website). Click
"Apply" and "OK" to add the dependency to your
project.

4. Create a new Java class: Right-click on the project in

the Package Explorer and select "New" -> "Class".
Provide a name for the class and click "Finish". This
class will contain your Rest-Assured test code.

5. Import necessary packages: In your Java class, import

the required Rest-Assured and related packages by
adding the following import statements at the top of
your class:

import [Link];
import [Link];
import [Link];

6. Write Rest-Assured code: Start writing your Rest-

Assured test code inside the Java class. You can use
the Rest-Assured API to make HTTP requests, set
request headers, validate responses, and perform
various other testing operations.
API

7. Run the Rest-Assured test: Right-click on your Java

class and select "Run As" -> "Java Application" to run
your Rest-Assured test. The test results will be
displayed in the Eclipse console.

• By following these steps, you can configure Eclipse

with Rest-Assured and start writing and running
Rest-Assured tests in your Java project.

IV. REST API Test using Rest Assured

To perform REST API testing using Rest Assured in Java,

follow these steps:

1. Set up a new Java project in your preferred IDE (e.g.,

Eclipse, IntelliJ).

2. Add the Rest Assured dependency to your project. You

can do this by including the following Maven
dependency in your project's [Link] file:

<dependency>
<groupId>[Link]-assured</groupId>
<artifactId>rest-assured</artifactId>
<version>4.4.0</version>
<scope>test</scope>
</dependency>
• Alternatively, you can manually download the Rest
Assured JAR file from the Maven repository or Rest
Assured website and add it to your project's
classpath.
API
3. Import the necessary packages in your test class:

import [Link];
import [Link];
import [Link];

4. Write your test code using the Rest Assured API.

Here's an example of a simple GET request:

public class APITest {

public static void main(String[] args) {
// Set the base URI for the API
[Link] = "[Link]

// Create a request specification

RequestSpecification request = [Link]();

// Send the GET request and get the response

Response response = [Link]("/users");

// Retrieve and print the response body

String responseBody = [Link]().asString();
[Link](responseBody);
}
}

• In this example, we set the base URI for the API,

create a request specification using
[Link](), send a GET request to the /users
endpoint, and retrieve and print the response body.
API
5. Run your test. You can run the test class as a Java
application or use your preferred test runner.

• By following these steps, you can perform REST API

testing using Rest Assured in Java.
• You can explore more features of Rest Assured to
handle different types of requests, headers, request
bodies, and response validations.

V. Validate Response Status using Rest Assured

• To validate the response status using Rest Assured,

you can use the following code:

import [Link];
import [Link];
import [Link];
import [Link];

public class APITest {

public static void main(String[] args) {
// Set the base URI for the API
[Link] = "[Link]

// Create a request specification

RequestSpecification request = [Link]();

// Validate
// Send the
the response status
GET request andcode
get the response
int statusCode
Response = [Link]();
response = [Link]("/users");
[Link](statusCode, 200, "Response status code is
not 200");

// Print the response body

String responseBody = [Link]().asString();
[Link](responseBody);
}
API

• In this example, after sending the GET request and

obtaining the response, we retrieve the status code
using [Link]().
• We then use the [Link]() method to
compare the status code with the expected value (in
this case, 200).
• If the status code does not match the expected value,
an assertion error will be thrown.
• You can customize the expected status code and
assertion message according to your specific test case.
• Rest Assured provides various methods to validate
different aspects of the response, such as response
headers, response time, JSON/XML response body,
etc.
• You can explore these methods to perform more
detailed response validations.

VI. Validate Response Header using Rest Assured

To validate the response headers using Rest Assured, you

can use the following code:
import [Link];
import [Link];
import [Link];
import [Link];

public class APITest {

public static void main(String[] args) {
// Set the base URI for the API
[Link] = "[Link]
API

• In this example, after sending the GET request and

obtaining the response, we retrieve the value of the
"Content-Type" header using
[Link]("Content-Type").
• We then use the [Link]() method to
compare the header value with the expected value (in
this case, "application/json").
• If the header value does not match the expected value,
an assertion error will be thrown.
• You can customize the expected header value and
assertion message according to your specific test case.
API
• Rest Assured provides various methods to validate
different aspects of the response headers, such as
presence of specific headers, checking header values,
etc.
• You can explore these methods to perform more
detailed header validations.

VII. Read JSON Response Body using Rest Assured

To read the JSON response body using Rest Assured, you

can use the following code:

import [Link];
import [Link];
import [Link];
import [Link];

public class APITest {

@Test
public void testAPI() {
// Set the base URI for the API
[Link] = "[Link]
// Create a request specification
RequestSpecification request = [Link]();
// Send the GET request and get the response
Response response = [Link]("/users");

// Get the JSON response body as a string

String responseBody = [Link]().asString();
[Link](responseBody);
• } In this example, after sending the GET request and
} obtaining the response, we use
[Link]().asString() to get the JSON
response body as a string.
API
• We then print the response body using
[Link]().
• You can further parse and manipulate the JSON
response body using libraries such as JSONPath or
Gson.
• These libraries provide methods to extract specific
values from the JSON structure, validate the response
against a schema, and perform other JSON-related
operations.
I. POST Request using Rest Assured

To send a POST request using Rest Assured, you can use

the following code:
import [Link];
import [Link];
import [Link];
import [Link];
import [Link];

public class APITest {

@Test
//public
Createvoid testAPI()
a request {
specification
// Set the base URI forrequest
RequestSpecification the API= [Link]();
[Link] = "[Link]
// Set the request headers and body
[Link]("Content-Type", "application/json");
[Link]("{\"name\": \"John\", \"email\":
\"john@[Link]\"}");

// Send the POST request and get the response

Response response = [Link]("/users");

// Get the response body and status code

String responseBody = [Link]().asString();
int statusCode = [Link]();

// Print the response body and status code

API

• In this example, we first set the base URI for the API
using [Link].
• Then, we create a RequestSpecification using
[Link]().
• Next, we set the request headers using
[Link]() and the request body using
[Link]().
• In this example, we set the Content-Type header to
application/json and provide a JSON body.
• Finally, we send the POST request using
[Link]("/users").
• We can then retrieve the response body and status
code using [Link]().asString() and
[Link]() respectively.
You can modify the request headers, body, and handle the
response based on your specific API requirements

7. REST API testing

Information

I. Serialization and Deserialization in Java

API
• Serialization and deserialization are processes used to
convert objects into a format that can be easily stored,
transmitted, or reconstructed.

1. Serialization:
a. Serialization is the process of converting an
object into a byte stream or a string
representation, which can be easily transmitted
or stored.
b. This is useful when you need to save the state of
an object or transmit it over a network.
c. In Java, serialization is achieved by implementing
the Serializable interface.

Example of serialization:

import [Link].*;

class Employee implements Serializable {

private String name;
private int age;
private double salary;

public Employee(String name, int age, double salary) {

[Link] = name;
[Link] = age;
[Link] = salary;
}

// Other methods and getters/setters

public static void main(String[] args) {

Employee employee = new Employee("John Doe", 30, 5000.0);

try {
FileOutputStream fileOut = new
FileOutputStream("[Link]");
API

• In this example, the Employee class implements the

Serializable interface.
• The main method demonstrates the serialization
process.
• An instance of Employee is created, and then it is
serialized by writing it to a file using
ObjectOutputStream.

2. Deserialization:
a. Deserialization is the reverse process of
serialization, where the byte stream or string
representation is converted back into an object.
b. This is useful when you need to reconstruct an
object from the stored or transmitted data.
c. In Java, deserialization is achieved by reading the
byte stream or string and converting it into an
object.
API

Example of deserialization:

import [Link].*;

class Employee implements Serializable {

private String name;
private int age;
private double salary;

// Constructor and other methods

public static void main(String[] args) {

Employee employee = null;

try {
FileInputStream fileIn = new FileInputStream("[Link]");
ObjectInputStream in = new ObjectInputStream(fileIn);
employee = (Employee) [Link]();
[Link]();
[Link]();
} catch (IOException e) {
[Link]();
return;
catch} (ClassNotFoundException e) {
[Link]("Employee class not found");
[Link]();
return;
}

[Link]("Deserialized Employee...");
[Link]("Name: " + [Link]());
[Link]("Age: " + [Link]());
[Link]("Salary: " + [Link]());
}
}
API

• In this example, the main method demonstrates the

deserialization process.
• It reads the serialized object from the file
"[Link]" using ObjectInputStream and casts it
back to an Employee object.
• Serialization and deserialization allow you to easily
save and restore the state of objects, transmit objects
over a network, or store them in a database.
• It's important to note that both the serialization and
deserialization processes should be handled properly
to ensure compatibility and security.

II. Deserialize Json Response

1. Deserializing a JSON response involves converting the

JSON data into an object representation that can be
used in your Java code.
2. There are several libraries available in Java for JSON
deserialization, such as Jackson, Gson, and JSON-B.
Here's an example using the Jackson library:

1. Add the Jackson dependency to your project. If you're

using Maven, add the following dependency to your
[Link] file:

<dependency>
<groupId>[Link]</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.12.4</version>
</dependency>
API

2. Create a Java class that represents the structure of the

JSON response. The class should have fields that
correspond to the JSON keys.

For example, let's say you have a JSON response like this:

{
"name": "John Doe",
"age": 30,
"salary": 5000.0
}

You can create a corresponding Java class:

import [Link];
public class Employee {
@JsonProperty("name")
private String name;

@JsonProperty("age")
@JsonProperty("salary")
private int age;
private double salary;

// Getters and setters

}

3. Use the Jackson library to deserialize the JSON

response into an instance of the Java class.

import [Link];

public class Main {

public static void main(String[] args) {
API

• In this example, the ObjectMapper class from the

Jackson library is used to deserialize the JSON
response into an instance of the Employee class.
• The readValue method takes the JSON response as a
string and the target class ([Link]) as
parameters.
• The resulting Employee object can then be used in
your code.
• Make sure to handle any exceptions that may occur
during the deserialization process, such as
JsonProcessingException.
API
III. Authentication and Authorization in REST
WebServices

• Authentication and authorization are important

aspects of securing RESTful web services.

Here's an explanation of each:

1. Authentication: Authentication is the process of

verifying the identity of the user or client making a
request to a RESTful web service. It ensures that only
authorized users can access protected resources.
Common authentication mechanisms used in RESTful
web services include:

2. Basic Authentication: The client includes a username

and password in the request headers. The server
verifies the credentials before allowing access.

3. Token-based Authentication: The client obtains a

token from the server after successful authentication.
The token is then included in subsequent requests for
authorization.

4. OAuth: OAuth is an open standard for authentication

and authorization. It enables a user to grant a third-
party application access to their protected resources
without sharing their credentials.

5. Authorization: Authorization determines what actions

or resources a user is allowed to access within a
RESTful web service. It ensures that authenticated
 API
users have appropriate permissions to perform
specific operations. Authorization can be role-based
or rule-based. Common authorization mechanisms
used in RESTful web services include:

6. Role-based Access Control (RBAC): Users are assigned

roles, and permissions are associated with those
roles. Users can only access resources and perform
operations allowed by their assigned roles.

7. Attribute-based Access Control (ABAC): Access to

resources is based on a set of attributes or conditions
defined in a policy. The policy evaluates attributes
associated with the user, resource, and environment
to make access control decisions.

• In RESTful web services, authentication and

authorization are typically implemented using
security standards and protocols such as OAuth,
JWT (JSON Web Tokens), OAuth2, or custom
authentication/authorization mechanisms specific
to the application or framework being used.
• It's important to note that the choice of
authentication and authorization mechanisms
depends on the specific requirements of the
application and the level of security needed.

IV. PUT Request using Rest Assured

To send a PUT request using Rest Assured, you can use

the following code:

import [Link];
API

// Send PUT request

Response response = [Link]("/users/123");

// Get response status code

int statusCode = [Link]();
[Link]("Response Status Code: " + statusCode);

// Get response body

String responseBody = [Link]().asString();
[Link]("Response Body: " + responseBody);
}
}
API
• In the above code, we first set the base URI using
[Link].
• Then, we create a RequestSpecification object by
calling [Link]().
• We can set the request headers using the header()
method, and set the request body using the body()
method.
• Finally, we send the PUT request by calling
[Link]("/users/123"), where "/users/123" is the
endpoint URL.
• We can retrieve the response status code using
[Link]() and the response body
using [Link]().asString().

Make sure to replace "[Link] with the

actual base URI and set the appropriate request headers
and body for your specific API.

V. DELETE Request using Rest Assured

To send a DELETE request using Rest Assured, you can use

the following code:

import [Link];
import [Link];
import [Link];

public class DeleteRequestExample {

public static void main(String[] args) {
// Set base URI
[Link] = "[Link]

// Create request
RequestSpecification request = [Link]();
API

• In the above code, we first set the base URI using

[Link].
• Then, we create a RequestSpecification object by
calling [Link]().
• We can set the request headers using the header()
method.
• Finally, we send the DELETE request by calling
[Link]("/users/123"), where "/users/123" is
the endpoint URL.
• We can retrieve the response status code using
[Link]().
• Make sure to replace "[Link] with
the actual base URI and set the appropriate request
headers for your specific API.
API
[Link] manipulation

Information

I. What is JSON?

• JSON (JavaScript Object Notation) is a lightweight

data interchange format that is easy for humans to
read and write and easy for machines to parse and
generate.
• It is a text-based format that is often used to transmit
data between a server and a web application as an
alternative to XML.
• JSON consists of key-value pairs where the keys are
strings and the values can be any valid JSON data
types, including strings, numbers, booleans, arrays,
and objects.
• It follows a hierarchical structure similar to that of
JavaScript objects.

Here is an example of a JSON object:

{
"name": "John Doe",
"age": 30,
"email": "[Link]@[Link]",
"hobbies": ["reading", "running", "cooking"],
"address": {
"street": "123 Main Street",
"city": "New York",
"country": "USA"
}
}
API

• In this example, "name", "age", "email", "hobbies", and

"address" are the keys, and their corresponding
values can be strings, numbers, arrays, or objects.
• JSON provides a simple and standardized way to
represent structured data that can be easily
understood and processed by different programming
languages.

II. JSONPath and Query JSON using JSONPath

• JSONPath is a query language used to extract data

from JSON documents.
• It provides a concise and powerful syntax for
navigating and filtering JSON structures.
• With JSONPath, you can specify the path to the
desired data elements within a JSON document using
a dot notation.
Here are some common JSONPath expressions:

1. $: Represents the root element of the JSON document.

2. $.key: Accesses the value of the specified key at the
root level.
3. $.key1.key2: Accesses the value of nested keys.
4. $.array[0]: Accesses the value at the specified index in
an array.
5. $.array[*]: Retrieves all values in an array.
6. $.key1.key2[?(@.key3 == 'value')]: Filters the JSON
document based on a condition.
API
• To query JSON using JSONPath, you can use libraries
or tools that support JSONPath, such as:

1. Java: libraries like Jayway JsonPath or RestAssured.

2. JavaScript: libraries like JSONPath-Plus or jsonpath.
3. Python: libraries like jsonpath-ng or jsonpath_rw.

Here's an example of querying JSON using JSONPath in Java

with the Jayway JsonPath library:

import [Link];

String json = "{ \"name\": \"John Doe\", \"age\": 30, \"hobbies\":

[\"reading\", \"running\", \"cooking\"] }";
String name = [Link](json, "$.name");
List<String> hobbies = [Link](json, "$.hobbies");

[Link]("Name: " + name);

[Link]("Hobbies: " + hobbies);

• This example extracts the "name" and "hobbies"

values from the JSON document using JSONPath
expressions and prints them to the console.
• JSONPath provides a flexible and powerful way to
extract specific data from JSON documents, making it
useful for data manipulation and filtering in various
programming languages and tools.

III. Expressions in JSONPath

API
• In JSONPath, expressions are used to specify the path
to the desired elements or values within a JSON
document.
• Expressions consist of a combination of JSONPath
operators, wildcards, and functions.

Here are some commonly used expressions in JSONPath:

1. Dot notation (.): The dot notation is used to access

properties or elements within a JSON object or array.

For example:

a. $.name - Accesses the value of the "name" property at

the root level.
b. $.[Link] - Accesses the value of the "city"
property nested within the "address" property.

2. Wildcard (*): The wildcard is used to match any

property or element within a JSON object or array.

For example:

a. $.employees[*] - Retrieves all elements within the

"employees" array.
b. $.*.email - Retrieves the value of the "email" property
from all objects at the root level.

3. Filter expression ([?]): The filter expression is used to

apply conditions to filter elements or properties
based on certain criteria. For example:
API
a. $.employees[?(@.age > 30)] - Retrieves all elements
within the "employees" array where the "age"
property is greater than 30.
b. $.employees[?(@.name == 'John')] - Retrieves all
elements within the "employees" array where the
"name" property is equal to "John".

4. Array index ([n]): The array index is used to access a

specific element within an array by its index. The
index starts from 0. For example:

a. $.numbers[0] - Accesses the first element in the

"numbers" array.
b. $.numbers[-1] - Accesses the last element in the
"numbers" array.

5. Functions: JSONPath provides various built-in

functions to perform operations on JSON data. Some
commonly used functions include:

a. min(), max(), avg(): Compute the minimum,

maximum, or average value from an array.
b. length(): Get the length of an array or the number of
properties in an object.
c. exists(): Check if a property or element exists in the
JSON document.

• These are just a few examples of the expressions that

can be used in JSONPath.
• The specific syntax and available operators may vary
depending on the JSONPath implementation or library
you are using.
API

IV. Deserialize JSON Array to List

To deserialize a JSON array into a Java List using a JSON

library such as Jackson or Gson, you can follow these steps:

1. Define a class that represents the structure of the

objects in the JSON array.

public class MyObject {

private String name;
private int age;

// Getters and setters (or use Lombok for auto-generating them)

}

2. Use the JSON library to parse the JSON array and map
it to a List of objects.

Using Jackson:

ObjectMapper objectMapper = new ObjectMapper();

Using Gson:
List<MyObject> myList = [Link](jsonArray, new
TypeReference<List<MyObject>>() {});

Gson gson = new Gson();

List<MyObject> myList = [Link](jsonArray, new
TypeToken<List<MyObject>>() {}.getType());

• Here, jsonArray represents the JSON array as a String.

API
• You can now work with the myList object, which
contains the deserialized JSON array as a List of
MyObject instances.

• Make sure to include the appropriate dependencies

for the JSON library you are using in your project.

V. Deserialize JSON Response to an Array

To deserialize a JSON response to an array in Java, you can

use a JSON library such as Jackson or Gson. Here's an
example using Jackson:

1. Define a class that represents the structure of the

JSON response.

public class MyObject {

private String name;
private int age;

// Getters and setters (or use Lombok for auto-generating them)

}
Use the JSON library to parse the JSON response and map
it to an array of objects.

ObjectMapper objectMapper = new ObjectMapper();

MyObject[] myArray = [Link](jsonResponse,
MyObject[].class);

• Here, jsonResponse represents the JSON response as a

String.
API
• You can now work with the myArray object, which
contains the deserialized JSON response as an array of
MyObject instances.
• Remember to include the appropriate dependencies
for the JSON library you are using in your project.

9. REST framework
Information

I. What is API Documentation?

• API documentation refers to the written

documentation that provides detailed information
about an API (Application Programming Interface).
• It serves as a reference guide for developers,
explaining how to interact with the API, what
endpoints are available, the required request
parameters and headers, the expected response
format, and any authentication or authorization
requirements.

API documentation typically includes the following

components:

1. Introduction: An overview of the API, its purpose, and

the key features it provides.

2. Endpoints and Methods: A list of available endpoints

(URLs) and the HTTP methods (GET, POST, PUT,
DELETE, etc.) supported by each endpoint.
API
3. Request Parameters: Detailed information about the
required and optional parameters that should be
included in the API requests, along with their data
types and formats.

4. Request Headers: Any additional headers that need to

be included in the API requests, such as
authentication tokens or content types.

5. Response Format: The expected format of the API

responses, including the data structure and any
specific error codes or error handling mechanisms.

6. Authentication and Authorization: If the API requires

authentication or authorization, the documentation
should provide instructions on how to obtain the
necessary credentials or tokens.

7. Examples: Sample API requests and responses to

demonstrate how to use the API.

8. Error Handling: Information about the error

messages and codes returned by the API, along with
possible troubleshooting steps.

9. Rate Limiting and Usage Policies: Any limitations or

restrictions on API usage, such as rate limits or data
usage policies.

• API documentation plays a crucial role in enabling

developers to understand and effectively use an API.
API
• It helps developers integrate the API into their
applications by providing clear instructions and
examples, reducing the learning curve and improving
the overall developer experience.

II. REST API End to End Test

• An end-to-end test for a REST API involves testing the

entire flow of an API request from start to finish,
including all the associated components and
interactions.
• It ensures that all the individual components of the
API are working together correctly and producing the
expected results.

Here is a step-by-step guide on how to perform an end-to-

end test for a REST API:

1. Understand the API: Familiarize yourself with the API

documentation, including the available endpoints,
request parameters, expected responses, and any
authentication or authorization requirements.

2. Identify test scenarios: Determine the specific test

scenarios you want to cover in your end-to-end
testing. This may include positive and negative test
cases, boundary conditions, and any special cases
relevant to your application.

3. Set up test data: Prepare the necessary test data,

including any required input data, preconditions, or
initial states required for the test scenarios.
API

4. Make API requests: Use a tool or framework such as

Rest Assured, Postman, or cURL to send API requests.
Include all the relevant request parameters, headers,
and authentication details.

5. Validate responses: Verify the responses received

from the API against the expected results. Check for
correct status codes, response payloads, and data
integrity.

6. Test error handling: Test the API's error handling

capabilities by intentionally sending invalid requests
or triggering error conditions. Verify that the API
responds appropriately with the expected error codes
and error messages.

7. Test data manipulation: If the API allows data

manipulation operations such as create, update, or
delete, test these operations to ensure they function
as expected. Verify that the changes are reflected
correctly in the response or subsequent requests.

8. Test integrations: If the API interacts with other

systems or services, ensure that the integrations are
working correctly. Test any data exchanges or
callbacks between the API and the external
components.

9. Test performance and scalability: Conduct

performance testing to measure the API's response
time, throughput, and scalability under different load
API
conditions. Identify any bottlenecks or performance
issues.

10. Clean up test data: After each test run, clean up

any test data created during the test to ensure a clean
test environment for subsequent tests.

11. Document and report: Document the test results,

including any issues or failures encountered during
the end-to-end testing. Report any bugs or
inconsistencies to the development team for
resolution.

• By performing end-to-end testing, you can ensure that

your REST API is functioning correctly and meets the
desired functionality, reliability, and performance
requirements.
• It helps uncover any issues or gaps in the API's
behaviour and ensures a smooth user experience
when interacting with the API.

Interview Questions:

1. What is API testing?

API testing is a type of software testing that focuses on

testing the functionality, reliability, and security of
application programming interfaces (APIs). It involves
testing the communication between different software
systems by sending requests and validating responses.
API
2. What are the common methods used in API testing?

The common methods used in API testing are GET, POST,

PUT, and DELETE. GET is used to retrieve data, POST is
used to create new data, PUT is used to update existing
data, and DELETE is used to remove data.

3. What is the difference between SOAP and REST APIs?

SOAP (Simple Object Access Protocol) is a protocol that

uses XML for communication and relies on complex
message formats. REST (Representational State Transfer)
is an architectural style that uses simple HTTP methods
and supports various data formats such as JSON and XML.

4. How do you handle authentication in API testing?

Authentication in API testing can be handled by including

the required credentials or tokens in the request headers.
Common authentication methods include Basic
Authentication, OAuth, and API keys.

5. What is the purpose of API documentation?

API documentation provides information about how to use

and interact with an API. It includes details about API
endpoints, request and response formats, authentication
requirements, and example usage scenarios.

6. What is parameterization in API testing?

API
Parameterization in API testing involves using different
input values for API requests to test different scenarios. It
allows testing the API with various data sets to validate its
behavior under different conditions.

7. How do you handle error handling in API testing?

Error handling in API testing involves validating the

response status codes, error messages, and error
structures returned by the API. Testers need to check if the
API handles errors gracefully and provides appropriate
error responses.

8. What are some common security considerations in

API testing?

Common security considerations in API testing include

validating secure communication over HTTPS, testing
input validation and data sanitization to prevent injection
attacks, and ensuring proper access controls and
authentication mechanisms are in place.

9. How do you handle API versioning in testing?

API versioning can be handled by including the version

number in the API endpoint URL or by using request
headers. Testers need to ensure that the correct version of
the API is being tested and that backward compatibility is
maintained.

10. How do you handle API performance testing?

API
API performance testing involves measuring the response
time and throughput of API requests under different loads.
Testers can use tools like JMeter or Gatling to simulate
concurrent users and monitor the performance metrics.

Assignment Questions:

1. Write a test case to verify the successful creation of a

new user through the API.
2. Develop a test script to validate the response time of
an API request under different load levels.
3. Design a test scenario to verify the error handling
capability of an API when invalid input data is
provided.
4. Create a test case to test the pagination feature of an
API that returns a large number of records.
5. Write a test script to verify the authentication process
of an API using OAuth 2.0.