API Automation Testing Using Rest Assured:
Comprehensive Notes
Table of Contents
1. Introduction to API Testing
2. What is an API?
3. Why API Testing is Important
4. Types of APIs
5. REST vs SOAP
6. HTTP Protocol
7. HTTP Methods
8. HTTP Status Codes
9. API Request Components
10. API Response Components
11. What is Rest Assured?
12. Rest Assured Architecture
13. Setting Up Rest Assured
14. Maven Dependencies
15. Project Structure
16. Sending API Requests
17. Validating Responses
18. JSON and XML Handling
19. Path Parameters
20. Query Parameters
21. Headers
22. Cookies
23. Authentication
24. Serialization
25. Deserialization
26. JSON Schema Validation
27. Logging
28. Assertions
29. Response Time Validation
30. File Upload and Download
31. API Chaining
32. Data-Driven API Testing
33. Framework Design
34. Best Practices
35. Advantages
36. Limitations
37. Interview Questions
38. Conclusion
1. Introduction to API Testing
API (Application Programming Interface) testing is a type of software testing that validates
communication between software components without involving the graphical user interface
(GUI). Unlike UI testing, API testing directly interacts with backend services to verify
functionality, reliability, security, and performance.
Modern applications are built using microservices where each service communicates with others
through APIs. Therefore, API testing has become an essential part of software quality assurance.
API automation allows testers to execute hundreds of API test cases quickly, repeatedly, and
consistently.
2. What is an API?
An API is a software interface that allows two applications to communicate with each other.
Example:
A mobile banking application does not directly access the database. Instead, it sends an API
request to the banking server.
The server processes the request and returns the response.
Client → API → Server → Database
Examples include:
Login API
Payment API
Customer Details API
Product API
Order API
Weather API
3. Why API Testing is Important
Benefits include:
Faster execution than UI testing
Detects defects early
Validates business logic
Tests backend independently
Easy automation
Improves software quality
Supports Continuous Integration
Reduces maintenance effort
API testing is often performed before UI testing because backend functionality is developed first.
4. Types of APIs
Public APIs
Accessible to anyone.
Example:
Weather APIs
Private APIs
Used internally within an organization.
Partner APIs
Shared between trusted business partners.
Composite APIs
Combine multiple services into one request.
5. REST vs SOAP
REST
Lightweight
Uses HTTP
JSON support
Faster
Easy to automate
SOAP
XML only
More secure
Uses WSDL
Complex structure
Slower
Today, REST APIs dominate modern application development.
6. HTTP Protocol
HTTP is the communication protocol used by REST APIs.
Request
Server
Response
Each request contains:
URL
Method
Headers
Body
Parameters
7. HTTP Methods
GET
Retrieve data.
Example:
Get customer information.
POST
Create new resource.
Example:
Create new user.
PUT
Replace existing resource.
PATCH
Update partial resource.
DELETE
Delete resource.
8. HTTP Status Codes
200 OK
Request successful.
201 Created
Resource created.
202 Accepted
Accepted for processing.
204 No Content
Success without response body.
400 Bad Request
Invalid request.
401 Unauthorized
Authentication failed.
403 Forbidden
Permission denied.
404 Not Found
Resource unavailable.
405 Method Not Allowed
Wrong HTTP method.
409 Conflict
Duplicate resource.
415 Unsupported Media Type
Wrong content type.
429 Too Many Requests
Rate limit exceeded.
500 Internal Server Error
Server issue.
502 Bad Gateway
Gateway error.
503 Service Unavailable
Service temporarily unavailable.
9. API Request Components
An API request contains:
Endpoint
URI
Method
Headers
Parameters
Cookies
Authentication
Request Body
10. API Response Components
Response contains:
Status Code
Headers
Body
Cookies
Response Time
11. What is Rest Assured?
Rest Assured is a Java library used for testing REST APIs.
It simplifies HTTP request creation and response validation.
Developed specifically for API automation, it integrates seamlessly with:
TestNG
JUnit
Maven
Jenkins
Allure Reports
Extent Reports
12. Rest Assured Architecture
Rest Assured follows the BDD approach.
Typical flow:
Given
When
Then
Example:
Given request specification
When send request
Then validate response
13. Setting Up Rest Assured
Requirements:
Java JDK
Maven
IntelliJ IDEA or Eclipse
TestNG/JUnit
Rest Assured Dependency
14. Maven Dependencies
Common dependencies include:
Rest Assured
TestNG
Jackson Databind
JSON Schema Validator
Hamcrest
Lombok (optional)
These dependencies simplify API automation development.
15. Project Structure
A professional framework typically contains:
src/test/java
├── testcases
├── base
├── utilities
├── payload
├── models
├── constants
├── listeners
├── reports
├── config
└── resources
This separation improves maintainability.
16. Sending API Requests
Rest Assured supports all HTTP methods.
Common request flow:
Given
Add headers
Add parameters
Add authentication
Add request body
When
Send request
Then
Validate response
17. Validating Responses
Response validation includes:
Status code
Headers
Cookies
JSON values
XML values
Response time
Validation ensures API correctness.
18. JSON and XML Handling
REST APIs commonly return JSON.
Older enterprise systems may return XML.
Rest Assured supports both formats.
19. Path Parameters
Path parameters identify resources.
Example:
/users/100
100 is the path parameter.
Used to retrieve specific records.
20. Query Parameters
Query parameters filter results.
Example:
?page=2
&size=20
&sort=name
Multiple query parameters can be combined.
21. Headers
Headers carry metadata.
Common headers include:
Content-Type
Accept
Authorization
Cache-Control
User-Agent
Headers define communication rules.
22. Cookies
Cookies maintain session information.
API testing verifies:
Cookie existence
Cookie values
Session management
23. Authentication
Authentication verifies user identity.
Common methods:
Basic Authentication
Bearer Token
OAuth 2.0
JWT
API Key
Digest Authentication
Each application chooses authentication based on security requirements.
24. Serialization
Serialization converts Java objects into JSON.
Java Object
JSON
Useful for POST and PUT requests.
25. Deserialization
Deserialization converts JSON into Java objects.
JSON
Java Object
Simplifies response validation.
26. JSON Schema Validation
Schema validation verifies:
Required fields
Data types
Mandatory properties
Array structures
Benefits:
Detects contract changes quickly.
27. Logging
Logging helps debugging.
Types:
Request Logging
Response Logging
Header Logging
Body Logging
Error Logging
Logs simplify failure analysis.
28. Assertions
Assertions verify expected results.
Examples include:
Status code
Response body
Response headers
Response size
JSON fields
Response time
Assertions determine pass or fail status.
29. Response Time Validation
Performance testing includes validating response time.
Example criteria:
Login API
Less than 1000 ms
Search API
Less than 3000 ms
Payment API
Less than 5000 ms
Performance thresholds vary by application.
30. File Upload and Download
Rest Assured supports:
Multipart file upload
Image upload
Document upload
PDF download
CSV download
Excel download
Automation validates file integrity after upload or download.
31. API Chaining
API chaining passes data from one API to another.
Example:
Login API
Token
Customer API
Customer ID
Order API
Order Details
Real-world applications frequently use chained APIs.
32. Data-Driven API Testing
Instead of hardcoding data, test inputs are stored externally.
Common sources:
Excel
CSV
JSON
XML
Database
Properties File
Benefits:
Easy maintenance
Multiple datasets
Reusable tests
33. Framework Design
A scalable Rest Assured framework generally includes:
Base Test
Configuration Files
Reusable Utilities
Request Builder
Response Validator
POJO Classes
TestNG Suite
Reporting
Logging
CI/CD Integration
The framework should support modularity and reuse.
34. Best Practices
Keep tests independent.
Use reusable request specifications.
Avoid hardcoded values.
Externalize configuration.
Validate both positive and negative scenarios.
Verify response body, status code, headers, and response time.
Implement proper exception handling.
Use logging for debugging.
Follow the Page Object–like pattern for API resources.
Maintain clean project structure.
Integrate with Jenkins for automated execution.
Execute tests in CI/CD pipelines.
Store sensitive credentials securely.
Generate HTML reports after execution.
Use version control systems like Git.
35. Advantages of Rest Assured
Open source.
Easy to learn for Java developers.
Supports BDD syntax.
Excellent JSON and XML support.
Seamless integration with TestNG and JUnit.
Powerful assertions with Hamcrest.
Supports authentication methods.
Enables API chaining.
Suitable for enterprise automation frameworks.
Easy integration with Maven and Jenkins.
36. Limitations
Java knowledge is required.
Designed primarily for REST APIs (SOAP support is limited).
Not intended for UI testing.
Performance testing generally requires dedicated tools such as JMeter or Gatling.
Large frameworks require disciplined project organization and maintenance.
37. Common Interview Questions
1. What is Rest Assured?
2. Why is API testing faster than UI testing?
3. Explain the Given–When–Then syntax.
4. Differentiate GET, POST, PUT, PATCH, and DELETE.
5. What is serialization and deserialization?
6. How do you validate JSON responses?
7. What are path parameters and query parameters?
8. How do you perform authentication using a Bearer token?
9. How do you implement API chaining?
10. What is JSON Schema Validation?
11. How do you handle dynamic response values?
12. How do you integrate Rest Assured with TestNG and Jenkins?
13. How do you build a reusable API automation framework?
14. How do you validate response headers and cookies?
15. How do you perform data-driven API testing?
38. Conclusion
Rest Assured has become one of the most popular libraries for REST API automation in the Java
ecosystem. Its fluent, readable syntax and extensive support for HTTP operations, authentication,
assertions, JSON/XML parsing, serialization, deserialization, and schema validation make it an
excellent choice for building robust API test suites.
In modern Agile and DevOps environments, API automation is an essential component of
Continuous Integration and Continuous Delivery (CI/CD). A well-designed Rest Assured
framework enables fast feedback, improves software quality, reduces regression effort, and
supports reliable application releases. By following best practices such as modular framework
design, reusable utilities, externalized test data, comprehensive validation, and integration with
reporting and CI tools, QA teams can create scalable and maintainable API automation solutions
that meet enterprise testing needs.