" !

Menu

API Testing : The

This is the Definitive Guide to Do API

Testing in 2020

Yes, I’ll cover the most important topics of

API Testing from start to end.

This guide is for any Software Tester or

Test Automation engineer who is looking

to learn What is API testing How it is done

at enterprise level using CI/CD.

I have included all video tutorials list of

API Testing using Postman that will make

you an expert in API testing.

Contents [show]

What is an API?
API stands for the Application

Programming Interface,

They are basically a collection of functions

and procedures which allows us to

communicate two applications or libraries.

In short, It is like a connector between two

services as shown in the picture.

How API works ?

In one line, API is its an interface

between different software programs or

service.

Let’s take a simple example,

Suppose you go to a restaurant.

API is the messenger(waiter) that takes

your order from you and tells to the chef in

(kitchen), what food to be prepared and

after some time waiter returns with the

ordered food.

Source – Quora.

[Link]

Type of APIs :-

What is API Testing?

When we talk about API Testing,

API testing is testing that APIs and its

integration with the services.

It is one of the most challenging types of

testing If we miss the certain cases in API

Testing that can cause a very big problem

in production after full integration and it

will hard to debug in the production

environment…

In this definite guide,

We are basically discussing the REST API

Testing.

What is REST API in API

As REST is an acronym for

REpresentational State Transfer,

statelessness is key. An API can be REST if

it follows the below constraints.

The REST architectural style describes six

constraints. These constraints, put on the

architecture, were initially communicated

by Roy Fielding in his doctoral dissertation

and defines the basis of RESTful-style.

Uniform Interface

Stateless

Cacheable

Client-Server

Layered System

Code on Demand

Uniform Interface

The uniform interface constraint defines

the interface between clients and servers.

In other terms,

The first constraint of the REST API states

that the Client and server has to

communicate and agree to certain rules

based on resources(they should

communicate with same resource like json,

xml, html , txt) and with proper encoding

like UTF-8 extra.

Another point they should communicate

with the Self-descriptive Messages e.g

Use the same MIME types.

Stateless

APIs in REST is stateless and Client and

server don’t worry about the state of the

request or response..

Cacheable

According to the World Wide Web, clients

can cache responses. Responses should,

therefore, implicitly or explicitly, define

themselves as cacheable. It’s up to server

when they want the cache to expired etc.

Client-Server

Client and Server are two different entity,

It means that servers and clients may also

be replaced and developed independently,

as long as the interface is not altered.

Layered System.

It means that the between client and

server there can be any number of layered

systems it does not matter.

Code on Demand

The server can store the Code or logic to

themselves and transfer it whenever

needed rather client-side logic.

If any API fulfill all the constraints then

we can REST API.

Difference between REST API

We have already discussed REST API,

Lets now Learn what is SOAP API.

SOAP (Simple Object Access Protocol)

It is a messaging protocol that allows

programs that run on disparate operating

systems or services like frontend or

backend to communicate using Hypertext

Transfer Protocol (HTTP) and its

Extensible Markup Language (XML).

SOAP uses WSDL is an XML format for

describing network services as a set of

endpoints operating on messages

containing either document-oriented or

procedure-oriented information.

What to Test in API Testing?

Validate the keys with the Min. and

Max range of APIs (e.g maximum

and minimum length)

Have a test case to do XML, JSON

Schema validation.

Keys verification. If we have JSON,

XML APIs we should verify it’s that

all the keys are coming.

Verify that how the APIs error codes

handled.

Why you should perform API

Many of the services that we use

every day rely on hundreds of

different interconnected APIs, if any

one of them fails then the service

will not work.

Right now, Internet uses millions of

APIs and they should be tested

thoroughly.

Developers make mistake and they

create buggy APIs…

Validation of APIs is very important

which are going live to production.

Above image shows the architecture of an

application and notice that API Testing is

an important part…

Now…

Let’s learn one more concept HTTP

Methods

HTTP – Fundamentals

HTTP is an application layer protocol

designed within the framework of the

Internet protocol suite.

Let’s learn one more concept HTTP

Methods

There is Client which perform a requested

resource which can be HTMLPage, file

extra from Server and server perform the

response to the client back using the same

protocol known as HTTP.

HTTP is a stateless protocol. In other

words, the current request does not know

what has been done in the previous

requests.

What are a Cookies?

Cookies are usually small text files, given

ID tags that are stored on your computer’s

browser directory or program data

subfolders.

1 GET /[Link] HTTP/1.1

Record the user’s browsing activity. Which

pages were visited in the past?

Contain the name of the domain &

Lifetime.

Tool : EditThisCookie –

[Link]

What are different types of

Authentications, let’s understand it…

What is Authentication?

Authentication is a process of presenting

your credentials like username, password

or another secret key to the system and

the system to validate your credentials or

you.

In the API terms;

Authentication is used to protect the

content over web mean only a valid user

with valid credentials can access that API

endpoint.

These credentials tell the system about

who you are. Which enables the system to

ensures and confirms a user’s identity.

Here system can be anything, it can be a

computer, phone, bank or any physical

office premises.

Basic authentication :

The string is encoded with Base64.

curl –header “Authorization: Basic

am9objpzZWNyZXQ=” [Link]

Digest Authentication :

Authentication is performed by

transmitting the password in an encrypted

form. (With Some Salt etc)

OAuth :

An Authentication protocol that allows

you to approve one application interacting

with another on your behalf without giving

away your password.

E.g OAuth 1, 2.

More authentication are discussed here –

[Link]

handle-authentications-with-postman/

What is an URL?

We can create an HTTP request from the

browser by typing a URL.

Just for more information, URL can be

broken down into further chunks like

protocol, host, post and query params.

More discussion is out of scope for URL

Let’s Understand what all HTTP methods

are present

HTTP Methods explained.

GET Method Explained