Back to Course|5 hours|Intermediate

API Testing & Web Services

Learn API testing techniques and web service validation.

Progress: 0/5 topics completed0%

Select Topics Overview

API Testing Fundamentals

Understand the basics of API testing and its importance in modern applications

Content by: Paras Dadhania

Software Testing & QA Specialist

Connect

What is API Testing?

API testing is a type of software testing that involves testing application programming interfaces (APIs) directly and as part of integration testing to determine if they meet expectations for functionality, reliability, performance, and security.

Why API Testing is Important

•Early Testing: Test business logic before UI is ready
•Faster Execution: APIs test faster than UI tests
•Language Independent: Test APIs regardless of frontend technology
•Core Functionality: Test the core business logic directly
•Integration Testing: Verify system integration
•Performance Testing: Test API performance under load

API Testing Types

Code Example

// Functional Testing
const functionalTests = {
    "Valid Input": "Test with valid request data",
    "Invalid Input": "Test with invalid request data",
    "Boundary Values": "Test edge cases and limits",
    "Error Handling": "Test error responses and codes",
    "Business Logic": "Test business rules and workflows"
};

// Non-Functional Testing
const nonFunctionalTests = {
    "Performance": "Response time and throughput",
    "Load Testing": "API behavior under normal load",
    "Stress Testing": "API behavior under extreme load",
    "Security Testing": "Authentication and authorization",
    "Reliability": "API availability and consistency"
};

// API Testing Levels
const testingLevels = {
    "Unit Level": "Individual API endpoints",
    "Integration Level": "API interactions with other systems",
    "End-to-End Level": "Complete API workflows",
    "Contract Level": "API contract validation"
};

Swipe to see more code

// Functional Testing
const functionalTests = {
    "Valid Input": "Test with valid request data",
    "Invalid Input": "Test with invalid request data",
    "Boundary Values": "Test edge cases and limits",
    "Error Handling": "Test error responses and codes",
    "Business Logic": "Test business rules and workflows"
};

// Non-Functional Testing
const nonFunctionalTests = {
    "Performance": "Response time and throughput",
    "Load Testing": "API behavior under normal load",
    "Stress Testing": "API behavior under extreme load",
    "Security Testing": "Authentication and authorization",
    "Reliability": "API availability and consistency"
};

// API Testing Levels
const testingLevels = {
    "Unit Level": "Individual API endpoints",
    "Integration Level": "API interactions with other systems",
    "End-to-End Level": "Complete API workflows",
    "Contract Level": "API contract validation"
};

Scroll

🎯 Practice Exercise

Test your understanding of this topic:

I understand the basic concepts covered in this topicI can apply the concepts in practical scenariosI'm ready to move to the next topic

REST API Testing

Master REST API testing techniques and best practices

Content by: Yash Sanghavi

Software Testing & QA Specialist

Connect

REST API Concepts

•HTTP Methods: GET, POST, PUT, DELETE, PATCH
•Status Codes: 200, 201, 400, 401, 404, 500
•Headers: Content-Type, Authorization, Accept
•Request/Response: JSON, XML, or other formats
•URL Structure: Base URL + endpoint + parameters

REST API Testing with Postman

Code Example

// GET Request Example
GET https://api.example.com/users/123
Headers:
  Authorization: Bearer token123
  Accept: application/json

Response:
{
  "id": 123,
  "name": "John Doe",
  "email": "john@example.com",
  "status": "active"
}

// POST Request Example
POST https://api.example.com/users
Headers:
  Content-Type: application/json
  Authorization: Bearer token123

Body:
{
  "name": "Jane Smith",
  "email": "jane@example.com",
  "password": "securepass123"
}

Response:
{
  "id": 124,
  "name": "Jane Smith",
  "email": "jane@example.com",
  "status": "active",
  "created_at": "2024-01-15T10:30:00Z"
}

// PUT Request Example
PUT https://api.example.com/users/123
Headers:
  Content-Type: application/json
  Authorization: Bearer token123

Body:
{
  "name": "John Updated",
  "email": "john.updated@example.com"
}

Response:
{
  "id": 123,
  "name": "John Updated",
  "email": "john.updated@example.com",
  "status": "active",
  "updated_at": "2024-01-15T11:00:00Z"
}

// DELETE Request Example
DELETE https://api.example.com/users/123
Headers:
  Authorization: Bearer token123

Response:
{
  "message": "User deleted successfully",
  "deleted_at": "2024-01-15T11:30:00Z"
}

Swipe to see more code

// GET Request Example
GET https://api.example.com/users/123
Headers:
  Authorization: Bearer token123
  Accept: application/json

Response:
{
  "id": 123,
  "name": "John Doe",
  "email": "john@example.com",
  "status": "active"
}

// POST Request Example
POST https://api.example.com/users
Headers:
  Content-Type: application/json
  Authorization: Bearer token123

Body:
{
  "name": "Jane Smith",
  "email": "jane@example.com",
  "password": "securepass123"
}

Response:
{
  "id": 124,
  "name": "Jane Smith",
  "email": "jane@example.com",
  "status": "active",
  "created_at": "2024-01-15T10:30:00Z"
}

// PUT Request Example
PUT https://api.example.com/users/123
Headers:
  Content-Type: application/json
  Authorization: Bearer token123

Body:
{
  "name": "John Updated",
  "email": "john.updated@example.com"
}

Response:
{
  "id": 123,
  "name": "John Updated",
  "email": "john.updated@example.com",
  "status": "active",
  "updated_at": "2024-01-15T11:00:00Z"
}

// DELETE Request Example
DELETE https://api.example.com/users/123
Headers:
  Authorization: Bearer token123

Response:
{
  "message": "User deleted successfully",
  "deleted_at": "2024-01-15T11:30:00Z"
}

Scroll

REST API Test Cases

Code Example

// Positive Test Cases
const positiveTestCases = [
    {
        "Test": "GET /users - Valid request",
        "Request": "GET https://api.example.com/users",
        "Expected": "200 OK, List of users"
    },
    {
        "Test": "POST /users - Create valid user",
        "Request": "POST with valid user data",
        "Expected": "201 Created, User object with ID"
    },
    {
        "Test": "PUT /users/123 - Update existing user",
        "Request": "PUT with updated data",
        "Expected": "200 OK, Updated user object"
    }
];

// Negative Test Cases
const negativeTestCases = [
    {
        "Test": "GET /users/999 - Non-existent user",
        "Request": "GET https://api.example.com/users/999",
        "Expected": "404 Not Found"
    },
    {
        "Test": "POST /users - Invalid data",
        "Request": "POST with missing required fields",
        "Expected": "400 Bad Request, Validation errors"
    },
    {
        "Test": "PUT /users/123 - Unauthorized",
        "Request": "PUT without valid token",
        "Expected": "401 Unauthorized"
    }
];

// Edge Cases
const edgeTestCases = [
    {
        "Test": "GET /users - Empty result",
        "Request": "GET with filter that returns no results",
        "Expected": "200 OK, Empty array"
    },
    {
        "Test": "POST /users - Duplicate email",
        "Request": "POST with existing email",
        "Expected": "409 Conflict, Duplicate email error"
    },
    {
        "Test": "PUT /users/123 - Large payload",
        "Request": "PUT with very large data",
        "Expected": "413 Payload Too Large"
    }
];

Swipe to see more code

// Positive Test Cases
const positiveTestCases = [
    {
        "Test": "GET /users - Valid request",
        "Request": "GET https://api.example.com/users",
        "Expected": "200 OK, List of users"
    },
    {
        "Test": "POST /users - Create valid user",
        "Request": "POST with valid user data",
        "Expected": "201 Created, User object with ID"
    },
    {
        "Test": "PUT /users/123 - Update existing user",
        "Request": "PUT with updated data",
        "Expected": "200 OK, Updated user object"
    }
];

// Negative Test Cases
const negativeTestCases = [
    {
        "Test": "GET /users/999 - Non-existent user",
        "Request": "GET https://api.example.com/users/999",
        "Expected": "404 Not Found"
    },
    {
        "Test": "POST /users - Invalid data",
        "Request": "POST with missing required fields",
        "Expected": "400 Bad Request, Validation errors"
    },
    {
        "Test": "PUT /users/123 - Unauthorized",
        "Request": "PUT without valid token",
        "Expected": "401 Unauthorized"
    }
];

// Edge Cases
const edgeTestCases = [
    {
        "Test": "GET /users - Empty result",
        "Request": "GET with filter that returns no results",
        "Expected": "200 OK, Empty array"
    },
    {
        "Test": "POST /users - Duplicate email",
        "Request": "POST with existing email",
        "Expected": "409 Conflict, Duplicate email error"
    },
    {
        "Test": "PUT /users/123 - Large payload",
        "Request": "PUT with very large data",
        "Expected": "413 Payload Too Large"
    }
];

Scroll

🎯 Practice Exercise

Test your understanding of this topic:

I understand the basic concepts covered in this topicI can apply the concepts in practical scenariosI'm ready to move to the next topic

SOAP API Testing

Learn SOAP API testing techniques and XML-based web services

Content by: Paras Dadhania

Software Testing & QA Specialist

Connect

SOAP API Concepts

•XML-based protocol for web services
•WSDL (Web Service Description Language)
•SOAP Envelope structure
•HTTP POST method for requests
•XML request/response format

SOAP Request/Response Example

Code Example

// SOAP Request
POST /soap/UserService HTTP/1.1
Host: api.example.com
Content-Type: text/xml; charset=utf-8
SOAPAction: "getUser"

<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header>
    <Authentication>
      <Token>abc123token</Token>
    </Authentication>
  </soap:Header>
  <soap:Body>
    <getUser xmlns="http://example.com/userservice">
      <userId>123</userId>
    </getUser>
  </soap:Body>
</soap:Envelope>

// SOAP Response
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8

<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <getUserResponse xmlns="http://example.com/userservice">
      <user>
        <id>123</id>
        <name>John Doe</name>
        <email>john@example.com</email>
        <status>active</status>
      </user>
    </getUserResponse>
  </soap:Body>
</soap:Envelope>

// SOAP Fault Response
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <soap:Fault>
      <faultcode>soap:Client</faultcode>
      <faultstring>Invalid user ID</faultstring>
      <detail>
        <ErrorCode>INVALID_USER_ID</ErrorCode>
        <ErrorMessage>User ID must be a positive integer</ErrorMessage>
      </detail>
    </soap:Fault>
  </soap:Body>
</soap:Envelope>

Swipe to see more code

// SOAP Request
POST /soap/UserService HTTP/1.1
Host: api.example.com
Content-Type: text/xml; charset=utf-8
SOAPAction: "getUser"

<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header>
    <Authentication>
      <Token>abc123token</Token>
    </Authentication>
  </soap:Header>
  <soap:Body>
    <getUser xmlns="http://example.com/userservice">
      <userId>123</userId>
    </getUser>
  </soap:Body>
</soap:Envelope>

// SOAP Response
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8

<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <getUserResponse xmlns="http://example.com/userservice">
      <user>
        <id>123</id>
        <name>John Doe</name>
        <email>john@example.com</email>
        <status>active</status>
      </user>
    </getUserResponse>
  </soap:Body>
</soap:Envelope>

// SOAP Fault Response
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <soap:Fault>
      <faultcode>soap:Client</faultcode>
      <faultstring>Invalid user ID</faultstring>
      <detail>
        <ErrorCode>INVALID_USER_ID</ErrorCode>
        <ErrorMessage>User ID must be a positive integer</ErrorMessage>
      </detail>
    </soap:Fault>
  </soap:Body>
</soap:Envelope>

Scroll

🎯 Practice Exercise

Test your understanding of this topic:

I understand the basic concepts covered in this topicI can apply the concepts in practical scenariosI'm ready to move to the next topic

Postman & API Testing Tools

Master Postman and other API testing tools for comprehensive API testing

Content by: Yash Sanghavi

Software Testing & QA Specialist

Connect

Postman Features

•Request Builder: Create and send HTTP requests
•Collections: Organize requests into folders
•Environment Variables: Manage different environments
•Pre-request Scripts: Set up test data
•Test Scripts: Automate API testing
•Mock Servers: Create mock APIs for testing
•Documentation: Generate API documentation

Postman Test Scripts

Code Example

// Postman Test Script Examples

// Basic Response Validation
pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("Response time is less than 2000ms", function () {
    pm.expect(pm.response.responseTime).to.be.below(2000);
});

pm.test("Response has required fields", function () {
    const jsonData = pm.response.json();
    pm.expect(jsonData).to.have.property('id');
    pm.expect(jsonData).to.have.property('name');
    pm.expect(jsonData).to.have.property('email');
});

// JSON Schema Validation
pm.test("Response matches schema", function () {
    const schema = {
        "type": "object",
        "properties": {
            "id": {"type": "number"},
            "name": {"type": "string"},
            "email": {"type": "string", "format": "email"},
            "status": {"type": "string", "enum": ["active", "inactive"]}
        },
        "required": ["id", "name", "email", "status"]
    };
    
    pm.response.to.have.jsonSchema(schema);
});

// Environment Variables
pm.test("Set user ID for next request", function () {
    const jsonData = pm.response.json();
    pm.environment.set("user_id", jsonData.id);
});

// Dynamic Data Generation
pm.test("Generate test data", function () {
    const randomEmail = pm.variables.replace("{{$randomEmail}}");
    const randomName = pm.variables.replace("{{$randomFullName}}");
    
    pm.environment.set("test_email", randomEmail);
    pm.environment.set("test_name", randomName);
});

// Authentication Token Handling
pm.test("Extract and store auth token", function () {
    const jsonData = pm.response.json();
    pm.environment.set("auth_token", jsonData.token);
});

// Collection Runner Scripts
pm.test("API Performance Test", function () {
    pm.expect(pm.response.responseTime).to.be.below(1000);
    pm.expect(pm.response.code).to.be.oneOf([200, 201]);
});

// Error Handling Tests
pm.test("Handle error responses", function () {
    if (pm.response.code >= 400) {
        const jsonData = pm.response.json();
        pm.expect(jsonData).to.have.property('error');
        pm.expect(jsonData).to.have.property('message');
    }
});

Swipe to see more code

// Postman Test Script Examples

// Basic Response Validation
pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("Response time is less than 2000ms", function () {
    pm.expect(pm.response.responseTime).to.be.below(2000);
});

pm.test("Response has required fields", function () {
    const jsonData = pm.response.json();
    pm.expect(jsonData).to.have.property('id');
    pm.expect(jsonData).to.have.property('name');
    pm.expect(jsonData).to.have.property('email');
});

// JSON Schema Validation
pm.test("Response matches schema", function () {
    const schema = {
        "type": "object",
        "properties": {
            "id": {"type": "number"},
            "name": {"type": "string"},
            "email": {"type": "string", "format": "email"},
            "status": {"type": "string", "enum": ["active", "inactive"]}
        },
        "required": ["id", "name", "email", "status"]
    };
    
    pm.response.to.have.jsonSchema(schema);
});

// Environment Variables
pm.test("Set user ID for next request", function () {
    const jsonData = pm.response.json();
    pm.environment.set("user_id", jsonData.id);
});

// Dynamic Data Generation
pm.test("Generate test data", function () {
    const randomEmail = pm.variables.replace("{{$randomEmail}}");
    const randomName = pm.variables.replace("{{$randomFullName}}");
    
    pm.environment.set("test_email", randomEmail);
    pm.environment.set("test_name", randomName);
});

// Authentication Token Handling
pm.test("Extract and store auth token", function () {
    const jsonData = pm.response.json();
    pm.environment.set("auth_token", jsonData.token);
});

// Collection Runner Scripts
pm.test("API Performance Test", function () {
    pm.expect(pm.response.responseTime).to.be.below(1000);
    pm.expect(pm.response.code).to.be.oneOf([200, 201]);
});

// Error Handling Tests
pm.test("Handle error responses", function () {
    if (pm.response.code >= 400) {
        const jsonData = pm.response.json();
        pm.expect(jsonData).to.have.property('error');
        pm.expect(jsonData).to.have.property('message');
    }
});

Scroll

🎯 Practice Exercise

Test your understanding of this topic:

I understand the basic concepts covered in this topicI can apply the concepts in practical scenariosI'm ready to move to the next topic

API Test Automation

Learn how to automate API testing using various frameworks and tools

Content by: Paras Dadhania

Software Testing & QA Specialist

Connect

API Automation Frameworks

•RestAssured (Java): Fluent API for REST testing
•Newman (Node.js): Command-line collection runner
•Pytest (Python): Python testing framework
•Karate: API testing framework
•Cypress: End-to-end testing with API support

RestAssured API Testing

Code Example

// RestAssured Maven Dependency
<dependency>
    <groupId>io.rest-assured</groupId>
    <artifactId>rest-assured</artifactId>
    <version>5.3.2</version>
</dependency>

// Basic RestAssured Test
import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;

public class APITest {
    
    @Test
    public void testGetUser() {
        given()
            .baseUri("https://api.example.com")
            .header("Authorization", "Bearer token123")
        .when()
            .get("/users/123")
        .then()
            .statusCode(200)
            .body("id", equalTo(123))
            .body("name", notNullValue())
            .body("email", containsString("@"))
            .time(lessThan(2000L));
    }
    
    @Test
    public void testCreateUser() {
        String userJson = """
            {
                "name": "John Doe",
                "email": "john@example.com",
                "password": "securepass123"
            }
            """;
        
        given()
            .baseUri("https://api.example.com")
            .contentType("application/json")
            .body(userJson)
        .when()
            .post("/users")
        .then()
            .statusCode(201)
            .body("id", notNullValue())
            .body("name", equalTo("John Doe"))
            .body("email", equalTo("john@example.com"))
            .body("status", equalTo("active"));
    }
    
    @Test
    public void testUpdateUser() {
        String updateJson = """
            {
                "name": "John Updated",
                "email": "john.updated@example.com"
            }
            """;
        
        given()
            .baseUri("https://api.example.com")
            .contentType("application/json")
            .body(updateJson)
        .when()
            .put("/users/123")
        .then()
            .statusCode(200)
            .body("name", equalTo("John Updated"))
            .body("email", equalTo("john.updated@example.com"));
    }
    
    @Test
    public void testDeleteUser() {
        given()
            .baseUri("https://api.example.com")
        .when()
            .delete("/users/123")
        .then()
            .statusCode(200)
            .body("message", equalTo("User deleted successfully"));
    }
}

// Data-Driven API Testing
@DataProvider(name = "userData")
public Object[][] getUserData() {
    return new Object[][] {
        {"John Doe", "john@example.com", "pass123"},
        {"Jane Smith", "jane@example.com", "pass456"},
        {"Bob Johnson", "bob@example.com", "pass789"}
    };
}

@Test(dataProvider = "userData")
public void testCreateUserWithData(String name, String email, String password) {
    String userJson = String.format("""
        {
            "name": "%s",
            "email": "%s",
            "password": "%s"
        }
        """, name, email, password);
    
    given()
        .baseUri("https://api.example.com")
        .contentType("application/json")
        .body(userJson)
    .when()
        .post("/users")
    .then()
        .statusCode(201)
        .body("name", equalTo(name))
        .body("email", equalTo(email));
}

Swipe to see more code

// RestAssured Maven Dependency
<dependency>
    <groupId>io.rest-assured</groupId>
    <artifactId>rest-assured</artifactId>
    <version>5.3.2</version>
</dependency>

// Basic RestAssured Test
import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;

public class APITest {
    
    @Test
    public void testGetUser() {
        given()
            .baseUri("https://api.example.com")
            .header("Authorization", "Bearer token123")
        .when()
            .get("/users/123")
        .then()
            .statusCode(200)
            .body("id", equalTo(123))
            .body("name", notNullValue())
            .body("email", containsString("@"))
            .time(lessThan(2000L));
    }
    
    @Test
    public void testCreateUser() {
        String userJson = """
            {
                "name": "John Doe",
                "email": "john@example.com",
                "password": "securepass123"
            }
            """;
        
        given()
            .baseUri("https://api.example.com")
            .contentType("application/json")
            .body(userJson)
        .when()
            .post("/users")
        .then()
            .statusCode(201)
            .body("id", notNullValue())
            .body("name", equalTo("John Doe"))
            .body("email", equalTo("john@example.com"))
            .body("status", equalTo("active"));
    }
    
    @Test
    public void testUpdateUser() {
        String updateJson = """
            {
                "name": "John Updated",
                "email": "john.updated@example.com"
            }
            """;
        
        given()
            .baseUri("https://api.example.com")
            .contentType("application/json")
            .body(updateJson)
        .when()
            .put("/users/123")
        .then()
            .statusCode(200)
            .body("name", equalTo("John Updated"))
            .body("email", equalTo("john.updated@example.com"));
    }
    
    @Test
    public void testDeleteUser() {
        given()
            .baseUri("https://api.example.com")
        .when()
            .delete("/users/123")
        .then()
            .statusCode(200)
            .body("message", equalTo("User deleted successfully"));
    }
}

// Data-Driven API Testing
@DataProvider(name = "userData")
public Object[][] getUserData() {
    return new Object[][] {
        {"John Doe", "john@example.com", "pass123"},
        {"Jane Smith", "jane@example.com", "pass456"},
        {"Bob Johnson", "bob@example.com", "pass789"}
    };
}

@Test(dataProvider = "userData")
public void testCreateUserWithData(String name, String email, String password) {
    String userJson = String.format("""
        {
            "name": "%s",
            "email": "%s",
            "password": "%s"
        }
        """, name, email, password);
    
    given()
        .baseUri("https://api.example.com")
        .contentType("application/json")
        .body(userJson)
    .when()
        .post("/users")
    .then()
        .statusCode(201)
        .body("name", equalTo(name))
        .body("email", equalTo(email));
}

Scroll

🎯 Practice Exercise

Test your understanding of this topic:

I understand the basic concepts covered in this topicI can apply the concepts in practical scenariosI'm ready to move to the next topic

Previous Module

Module 4: Automation Testing Fundamentals

Next Module

Module 6: Performance Testing

Ready for the Next Module?

Continue your learning journey and master the next set of concepts.

Continue to Module 6

Module 5: API Testing & Web Services

API Testing & Web Services

Select Topics Overview

API Testing Fundamentals

REST API Testing

SOAP API Testing

Postman & API Testing Tools

API Test Automation

API Testing Fundamentals

REST API Testing

SOAP API Testing

Postman & API Testing Tools

API Test Automation

API Testing Fundamentals

What is API Testing?

Why API Testing is Important

API Testing Types

🎯 Practice Exercise

REST API Testing

REST API Concepts

REST API Testing with Postman

REST API Test Cases

🎯 Practice Exercise

SOAP API Testing

SOAP API Concepts

SOAP Request/Response Example

🎯 Practice Exercise

Postman & API Testing Tools

Postman Features

Postman Test Scripts

🎯 Practice Exercise

API Test Automation

API Automation Frameworks

RestAssured API Testing

🎯 Practice Exercise

Module 4: Automation Testing Fundamentals

Module 6: Performance Testing

Ready for the Next Module?