Introduction to API Testing

Understand what API testing is, why it matters, REST vs SOAP, HTTP methods, status codes, and how API testing fits into the testing pyramid.

What is API Testing?

API (Application Programming Interface) testing is a type of software testing that validates APIs directly — checking functionality, reliability, performance, and security. Unlike UI testing, API testing operates at the business logic layer, making it faster, more stable, and more reliable.

Why API Testing Matters

APIs are the backbone of modern software. Whether it's a mobile app communicating with a backend, microservices talking to each other, or third-party integrations — everything flows through APIs. Testing them ensures your application's core logic works correctly before the UI is even built.

REST vs SOAP

REST (Representational State Transfer) is the dominant API style today. It uses standard HTTP methods, is stateless, and typically communicates with JSON. SOAP (Simple Object Access Protocol) uses XML, has built-in WS-Security, and is more rigid. This course focuses on REST APIs, which account for the majority of modern web services.

HTTP Methods

REST APIs rely on standard HTTP methods to perform operations:

• GET — Retrieve data (read-only, idempotent)
• POST — Create new resources
• PUT — Update/replace an entire resource
• PATCH — Partially update a resource
• DELETE — Remove a resource

HTTP Status Codes

Every API response includes a status code that tells you what happened:

• 2xx — Success (200 OK, 201 Created, 204 No Content)
• 3xx — Redirection (301 Moved, 304 Not Modified)
• 4xx — Client errors (400 Bad Request, 401 Unauthorized, 404 Not Found)
• 5xx — Server errors (500 Internal Server Error, 503 Service Unavailable)

The Testing Pyramid

API tests sit in the middle of the testing pyramid — faster than UI tests but providing broader coverage than unit tests. A healthy test suite typically has many unit tests, a solid layer of API tests, and fewer UI tests at the top.

Tools We'll Use

Throughout this course, every example is shown in three languages with industry-standard libraries:

• Java — RestAssured: The most popular Java library for REST API testing
• JavaScript — Fetch API (with Node.js): Built-in, modern, promise-based HTTP client
• Python — Requests: The most beloved HTTP library in Python, simple and elegant

// JavaScript — Using Fetch API (Node.js 18+)
// Fetch is built into modern Node.js — no installation needed!

// Simple GET request
const response = await fetch('https://jsonplaceholder.typicode.com/posts/1');
const data = await response.json();

console.log('Status:', response.status);    // 200
console.log('Title:', data.title);          // Post title
console.log('Content-Type:', response.headers.get('content-type'));

// Quick check
console.assert(response.ok, 'Request should succeed');
console.assert(data.id === 1, 'Should return post with id 1');

// Java — Using RestAssured
// Add to pom.xml:
// <dependency>
//   <groupId>io.rest-assured</groupId>
//   <artifactId>rest-assured</artifactId>
//   <version>5.4.0</version>
//   <scope>test</scope>
// </dependency>

import io.restassured.RestAssured;
import io.restassured.response.Response;
import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;

public class IntroRestAssured {

    public static void main(String[] args) {
        // Simple GET request
        Response response =
            given()
                .baseUri("https://jsonplaceholder.typicode.com")
            .when()
                .get("/posts/1")
            .then()
                .statusCode(200)
                .body("id", equalTo(1))
                .extract().response();

        System.out.println("Status: " + response.getStatusCode());
        System.out.println("Title: " + response.jsonPath().getString("title"));
    }
}

# Python — Using Requests library
# Install: pip install requests

import requests

# Simple GET request
response = requests.get('https://jsonplaceholder.typicode.com/posts/1')

print(f"Status: {response.status_code}")      # 200
print(f"Title: {response.json()['title']}")    # Post title
print(f"Content-Type: {response.headers['Content-Type']}")

# Quick assertions
assert response.status_code == 200, "Request should succeed"
assert response.json()['id'] == 1, "Should return post with id 1"

# Requests makes it intuitive
print(f"Response OK: {response.ok}")  # True for 2xx