✅ API & POSTMAN – LONG THEORY ANSWERS

(Manual Tester / AQM – Fresher Level)

1️⃣ What is an API?

An API (Application Programming Interface) is a way for two software applications to communicate with each other.

APIs are commonly used in web and mobile applications. For example, when we log in to an app, fetch user details, or
submit a form, the UI sends a request to an API, and the API processes it and returns the result. APIs mostly use HTTP
methods and exchange data in formats like JSON.

2️⃣ What is an API Request?

An API request is the information sent from the client (UI, Postman, or another application) to the server to perform an
action.

A request usually contains:

 HTTP method (GET, POST, PUT, DELETE)

 Endpoint (URL)
 Headers (like Content-Type, Authorization)
 Body/Payload (in POST or PUT requests)

For example, when we want to create a user, we send a POST request with user details in the request body.

3️⃣ What is an API Response?

An API response is the information returned by the server after it processes the request.

A response includes:

 Status code (200, 201, 400, etc.)

 Response body (data or error message)
 Response headers
 Response time

As a tester, I verify whether the response contains correct data, proper status code, and meaningful error messages.

4️⃣ What does “return” mean in API?

In API terms, return means the result that the server sends back after executing a request.

The return can be:

 Data (like user details)

 Success message
  Error message
 Status code only (like 204 No Content)

For example, a GET request may return user data, while a DELETE request may return only a success status.

5️⃣ Why is API testing important?

API testing is important because it validates the backend logic of the application. Even if the UI is not ready, we can still
test APIs.

API testing helps to:

 Validate business rules

 Ensure data is correct in database
 Test performance and response time
 Verify security and authentication
 Find defects early in the development cycle

It is faster, more reliable, and more stable compared to UI testing.

6️⃣ What are HTTP methods?

HTTP methods define the type of action performed on the server.

 GET – Used to fetch or read data

 POST – Used to create new data
 PUT – Used to update complete data
 PATCH – Used to update partial data
 DELETE – Used to remove data

These methods are part of CRUD operations (Create, Read, Update, Delete).

7️⃣ What are HTTP status codes?

HTTP status codes are numbers returned by the server to indicate the result of an API request.

They help testers quickly understand whether the request succeeded or failed and why.

8️⃣ Explain common HTTP status codes.

 200 OK – Request successful

 201 Created – New resource created
 204 No Content – Request successful but no data returned
 400 Bad Request – Invalid input or missing fields
 401 Unauthorized – Authentication required
 403 Forbidden – Access denied
 404 Not Found – Resource or URL not found
 409 Conflict – Duplicate or already existing data
 500 Internal Server Error – Server-side issue
9️⃣ What is JSON?

JSON (JavaScript Object Notation) is a lightweight data format used to send and receive data in APIs.

It is:

 Easy to read and write

 Language independent
 Commonly used in REST APIs

Most modern APIs use JSON for request and response bodies.

1️⃣1️⃣ What is an API Endpoint?

An endpoint is the specific URL where the API request is send.

Each endpoint represents a particular function or resource, such as:

 /login
 /users/1
 /orders

1️⃣2️⃣ What are API Headers?

Headers are additional information sent with the request or response.

They are used for:

 Authentication (Authorization)
 Data format (Content-Type)
 Server instructions

Headers are important for Security and Authentication.

Without correct headers, the API may reject the request.

1️⃣3️⃣ What is Payload?

Payload is the data sent in the request body during POST, PUT, or PATCH requests.

It usually contains information like user details, login credentials, or product data.

1️⃣4️⃣ What is Authentication in API?

Authentication is the process of verifying the identity of a user or system before allowing access.
Common authentication types:

 API Key
 Bearer Token
 Basic Authentication
 OAuth

1️⃣5️⃣ What is Postman?

Postman is a popular tool used for manual API testing.

Using Postman, testers can:

 Send API requests

 Add headers and payload
 Validate responses
 Save requests in collections
 Use environment variables

1️⃣6️⃣ How do you test APIs using Postman?

In Postman, I:

1. Select the HTTP method

2. Enter the API endpoint
3. Add headers and payload if required
4. Send the request
5. Validate status code, response body, headers, and response time

1️⃣7️⃣ What are Environment Variables in Postman?

Environment variables are key-value pairs used to store reusable data such as base URLs, tokens, and IDs.

They help in switching between Dev, QA, and Prod environments easily.

1️⃣8️⃣ Why are environment variables important?

Environment variables:

 Avoid hardcoding values

 Improve reusability
 Support API chaining
 Increase security
 Make testing faster and cleaner

1️⃣9️⃣ What is {{base_url}}?

{{base_url}} is a placeholder variable that stores the main API URL and is reused in all requests.
2️⃣0️⃣ What is a Postman Collection?

A collection is a group of related API requests organized together.

Collections help manage large APIs and perform end-to-end testing.

2️⃣1️⃣ Why are collections important in Postman?

Collections are important because they:

 Organize API requests

 Support reusability
 Enable end-to-end testing
 Allow automation using Collection Runner
 Make sharing easy

2️⃣2️⃣ What is Collection Runner?

Collection Runner executes multiple API requests automatically in sequence.

2️⃣3️⃣ What is API chaining?

API chaining means using data from one API response, like ID or token, in another API request.

2️⃣4️⃣ What is Black-box testing in API?

Black-box testing means testing APIs without knowing internal backend code, focusing only on inputs and outputs.

2️⃣5️⃣ How do you troubleshoot API issues?

To troubleshoot API issues, I check:

 Correct URL and method

 Headers and authentication
 Payload format
 Environment variables
 Response logs and error messages

2️⃣6️⃣ How do you explain API testing in interview?

Perfect closing answer:

“I have a basic understanding of API testing using Postman. I test requests and responses, validate status codes, headers,
payloads, authentication, and perform positive and negative testing to ensure backend functionality.”

Token:

 A token is a temporary secret given by the server after a user logs in.
 It is used in each API request to verify the user.
 Tokens can expire and may need a refresh.
 Example: Bearer Token, JWT
 “Jar user login kela ahe ani secure data access karaycha ahe, tar Token vapra.”

API Key:

 An API key is a static unique identifier for an application or user.

 It is sent with every request to identify and authorize the client.
 API keys usually don’t expire but can be regenerated if compromised.
 “Jar user login nahi karat, fkt app access dene ahe, tar API Key vapra.”

Example:

 OpenWeatherMap API – temperature fetch karaycha

 Google Maps API – location data fetch karaycha

1. The "Testing Mindset" (Positive vs. Negative)

Interviewers don't just want to know if you know what a 404 is; they want to know if you can find it. Add these two
concepts to your theory:

 Positive Testing: Sending valid data to ensure the API works as expected (Status 200/201).
 Negative Testing: Sending invalid data (wrong data types, empty fields, expired tokens) to see if the API handles
errors gracefully (Status 400/401/403).

2. Understanding API Documentation (Swagger)

In a real job, you don't guess the endpoints. You read a document.

 Question: "How do you know what to test in an API?"

 Answer: "I refer to the API Documentation, usually Swagger or a Postman Documentation link. It tells me the
Endpoint, the required Headers, and the expected Request/Response body."

3. Real-World Scenario: The "Login" Flow

If an interviewer says, "Explain how you would test a Login API," use this structured theory:

1. Check Requirement: Look at Swagger for the /login endpoint.

2. Positive Test: Enter valid email/password $\rightarrow$ Expect 200 OK + Bearer Token.
3. Negative Test (Wrong Password): Enter valid email + wrong password $\rightarrow$ Expect 401
Unauthorized.
4. Negative Test (Missing Field): Send password but no email $\rightarrow$ Expect 400 Bad Request.
4. API vs. UI Testing (The "Why")

You mentioned why it's important, but this specific comparison is a favorite interview question:

Feature UI Testing API Testing

Speed Slow (Browser takes time) Very Fast

Stability Fragile (UI elements change) Very Stable

Coverage Tests "How it looks" Tests "The Core Logic"

Bug Detection Late in the cycle Very Early

Common API Request Components

 Query Parameters: Optional key–value pairs appended to the URL

Example:
GET /employees?department=HR
 Path Variables: Dynamic part of the URL
Example:
GET /employees/{id} → /employees/101
 Headers:
o Content-Type: application/json
o Authorization: Bearer <token>
 Body: JSON data sent in POST, PUT, PATCH requests
Example:
 {
 "name": "John Doe",
 "department": "HR",
 "salary": 50000
 }

⭐ Top 5 Scenario-Based API Testing Questions

(Easy words – Fresher Friendly)

1️⃣ If you send a request in Postman and get 404 Not Found, what will you check?

👉 Meaning: Server says “this API does not exist”.

My step-by-step answer:

 First, I check the URL / Endpoint

Maybe spelling mistake like /user instead of /users.
 Then I check base URL
Am I using correct environment? (Dev or QA)
  Then I check HTTP method
Maybe I used GET but API expects POST.
 Then I check ID or path parameter
Example: /users/101 → maybe user 101 does not exist.

✅ Most of the time, 404 happens because of wrong URL or wrong ID.

2️⃣ You get 200 OK, but response body is empty { }. Is it a bug?

👉 Simple answer:
“It depends on the requirement.”

Explain like this:

 If I search for a user who does not exist,

then 200 with empty body can be correct.
 But if I am fetching active users / products and response is empty,
then it may be a data issue or backend logic issue.

👉 In this case, I will check database or confirm with developer.

3️⃣ How do you test if an API is secure?

As a fresher, I do basic security testing:

🔹 Authentication

 I call API without token

 Expected result → 401 Unauthorized

🔹 Authorization

 I try to access Admin API with normal user token

 Expected result → 403 Forbidden

🔹 Invalid input

 I send wrong or special characters like

' OR '1'='1
 API should not crash and should return proper error

4️⃣ What is API Chaining? Have you done it?

👉 Simple meaning:
Using response of one API in another API.

Example (easy):

 Step 1: Call Login API → get token

 Step 2: Save token in Postman variable
 Step 3: Use same token in Header of another API
👉 Without token, next API will fail.

So API chaining is required for end-to-end testing.

5️⃣ Difference between 401 and 403 error?

👉 Very easy explanation (Interview GOLD):

 401 Unauthorized
👉 “I don’t know who you are”
(Token missing or wrong login)
 403 Forbidden
👉 “I know who you are, but you don’t have permission”
(Normal user trying admin API)

✅ Final Easy Revision Table

If interviewer asks… You say…

Tools Postman, Swagger

Data format JSON, XML

HTTP Methods GET, POST, PUT, DELETE

Success codes 200, 201

Client errors 400, 401, 403, 404

Server error 500

⭐ One-Line Confidence Answer (Must Remember)

“I have basic understanding of API testing using Postman. I validate requests, responses, status codes, authentication, error
handling, and perform basic security and end-to-end testing.”

1️⃣ “Have you used Postman?”

👉 Expected answer:

“Yes, I have a basic understanding of API testing using Postman. I use it to send requests and validate responses.”

2️⃣ “If you get a 404 error, what will you do?”

👉 What the interviewer wants:

They want to see your thinking process, not textbook definitions.

Good answer:
“First, I check the endpoint URL for any spelling mistake.
Then I check whether I am using the correct base URL or environment.
After that, I verify the HTTP method and also check if the ID or resource actually exists.”

3️⃣ “What is the difference between 401 and 403?”

👉 Very common fresher question

Answer:

401 Unauthorized means authentication is missing or incorrect.

403 Forbidden means authentication is correct, but the user does not have permission to access that resource.

4️⃣ “What happens if you call an API without a token?”

👉 Expected answer:

“The API should return a 401 Unauthorized error because authentication is required.”

---------------------------------------------------------------------------------------

Path Params vs Query Params

Path Parameters

 Path parameters are part of the URL path.

 They are used to identify a specific resource.
 They are usually mandatory.
 Example:

GET /users/101

Here, 101 is the userId (path parameter).

When to use:

Use path parameters when you want a single, specific record (user, order, product).

Query Parameters

 Query parameters come after ? in the URL.

 They are used to filter, search, sort, or paginate data.
 They are usually optional.
 Example:

GET /users?status=active&city=Mumbai

Here, status and city are query parameters.

When to use:

Use query parameters when you want to modify or filter the response.
Easy way to remember

 Path Params → Which record?

 Query Params → How do you want the data?

6️⃣ “Have you done API chaining?”

👉 Even a simple example is enough

Answer:

“Yes. I have done basic API chaining.

For example, I first call the login API to get a token, save that token in a variable, and then use it in the header of another
API.”

🧠 What the Interviewer Is Really Checking

“Can this candidate identify and handle real production issues?”

That’s why they ask scenario-based questions, not just definitions.

⭐ Fresher-Friendly Golden Line (Very Important)

If you can say this confidently, you can clear 80% of fresher interviews:

“I check the URL, HTTP method, headers, token, payload, status code, and response body.”

💡 Final Confidence Booster

If your resume says:

Basic understanding of API testing using Postman

👉 This is exactly the level expected from a fresher.

You are not expected to know automation or deep backend concepts.

🔥 What to Remember

 Interviewers check thinking, not perfection

 Step-by-step answers get extra points
 Calm and clear answers increase selection chances
Perfect topic to start with, Samiksha 👍
👉 Core Validation is the heart of API testing.
If you explain this well in interviews, interviewer knows you understand real testing, not just
Postman clicks 😊

I’ll explain each point fully, in practical + tester language.