API Testing

Why test at the API layer

Faster, more deterministic and more precise than UI tests, and it catches what a UI can hide (a UI may swallow a 500 and show cached data). Always cross-check a UI-observed bug against the raw API response before filing: it tells you whether the fault is frontend or backend.

Per-endpoint checklist

Contract and schema validation

Validate responses against the OpenAPI/JSON Schema/GraphQL schema programmatically, not by eyeballing JSON. Drift between documentation and behavior is a bug even when "the API works". Consumer-driven contracts: contract-testing. Spec-driven fuzzing finds crashes and violations automatically:

schemathesis run https://staging.example.com/openapi.json --checks all --hypothesis-max-examples=100
dredd openapi.yaml https://staging.example.com          # example-based contract run

Tooling (pick what fits the stack)

curl -sS -i -X POST "$API/orders" -H "Authorization: Bearer $TOKEN" -H "Idempotency-Key: $(uuidgen)" \
  -H 'Content-Type: application/json' -d '{"sku":"A-1","qty":2}'
hurl --test --variable host=$API orders.hurl

# pytest: auth matrix as parametrized data
@pytest.mark.parametrize("token,expected", [(None,401), ("expired",401), ("user",403), ("admin",200)])
def test_admin_endpoint_access(client, tokens, token, expected):
    r = client.get("/admin/reports", headers=auth(tokens.get(token)))
    assert r.status_code == expected

Security-adjacent checks (depth in security-testing)

Object-level authorization by changing IDs · mass assignment ("role":"admin" in a body is ignored/rejected) · injection through every string field, header and filename · SSRF on any "fetch this URL" feature · excessive data exposure (fields the client never needs) · verbose errors.

Performance sanity

Record p50/p95 latency per endpoint in the suite and fail on regressions beyond a threshold; deeper work in performance-testing.

Reporting

Include the exact request (method, URL, relevant headers, body) and the full response, plus environment and timestamp. "The API is broken" without the request/response pair is not actionable. Format: bug-reporting.

Related

contract-testing, graphql-testing, authn-authz-testing, integration-testing, security-testing, bug-reporting