8
API Testing Mistakes
That Keep QA Engineers
at Junior Level
Stop Testing for Success. Start Testing for Failure.
Aston Cook
Senior QA Automation Engineer
Mistake #1
Only Testing Happy Paths
The Mistake
You send valid data, get a 200 response, and move on. Test passes. You feel
productive. Time for the next endpoint.
Why It Matters
Real users don't always send valid data. Hackers definitely don't. The bugs that reach
production are hiding in the unhappy paths you never tested.
The Fix
For every endpoint, test: missing required fields, invalid data types, empty strings, null
values, boundary values (0, -1, MAX_INT), and special characters.
Mistake #2
Ignoring Auth Edge Cases
The Mistake
You test with a valid token and call it done. Maybe you test with no token. That covers
authentication, right?
Why It Matters
Authentication is where security vulnerabilities hide. Expired tokens, malformed tokens,
tokens for wrong users, tokens with insufficient permissions. These bugs can be
catastrophic.
The Fix
Test: expired tokens, invalid token format, token for different user, token with insufficient
permissions, missing token, token in wrong header location.
Mistake #3
Not Testing Error Responses
The Mistake
You verify the success response body in detail. For errors, you just check that it returns
400 or 500. Good enough.
Why It Matters
Error responses leak information. They can expose stack traces, database details,
internal paths. They can also be inconsistent, breaking frontend error handling.
The Fix
Verify error response structure, error message format, that no sensitive data is leaked,
and that error codes are consistent across all endpoints.
Mistake #4
Skipping Response Time Checks
The Mistake
The API returns correct data. Test passes. You never check how long it took.
Performance is someone else's job.
Why It Matters
An endpoint that takes 8 seconds technically works but destroys user experience.
Performance issues start small and grow. By the time users complain, it's a crisis.
The Fix
Add response time assertions to critical endpoints. Set thresholds (< 500ms for simple
GETs). Track trends over time. Alert when performance degrades.
Mistake #5
Testing in Isolation Only
The Mistake
You test each endpoint separately. Create user works. Get user works. Delete user
works. All green. Ship it.
Why It Matters
Real usage is sequential. Create, then Get, then Update, then Delete. State changes
between calls. Bugs hide in the transitions between endpoints.
The Fix
Write end-to-end API flows that mirror real user journeys. Test the full sequence. Verify
that actions in one endpoint correctly affect others.
Mistake #6
Ignoring Rate Limits
The Mistake
You never test what happens when you hit the API too fast or too often. Rate limits
exist, but you've never verified them.
Why It Matters
Rate limits protect your system from abuse. If they don't work, one bad actor can take
down your service. If they're too aggressive, legitimate users get blocked.
The Fix
Test rate limit boundaries. Verify correct 429 responses. Check that limits reset
properly. Ensure critical endpoints have appropriate protection.
Mistake #7
Not Validating Response Schema
The Mistake
You check that 'name' exists in the response. You don't verify the full structure. Field is
there, test passes.
Why It Matters
APIs evolve. Fields get added, removed, renamed, or change types. Frontend code
expects specific structures. Schema mismatches cause silent, hard-to-debug failures.
The Fix
Use schema validation (JSON Schema, Zod, etc.). Verify all expected fields exist with
correct types. Catch breaking changes before they break the frontend.
Mistake #8
Forgetting Database State
The Mistake
You test the API response but never verify what actually happened in the database.
Response says success, so it must be fine.
Why It Matters
The API might return 'success' while silently failing to persist data. Or it might persist
incorrect data. The response can lie. The database tells the truth.
The Fix
For critical operations, verify database state directly. Check that data was actually
created, updated, or deleted. Verify relationships and constraints.
The Shift
Junior:
"Does it work?"
Senior:
"How can it break?"
Same API. Different questions.
Different careers.
Start testing for failure.
Your bug detection will improve.
Your interviews will improve.
Your career will improve.
Save this. Share it with your team.
Follow for more API testing content.
Aston Cook
Senior QA Automation Engineer @ Resilience