In this post I have written the detailed API testing tutorials or you can call it as useful guide as well for your reference
What is API?
- API stands for application programming interface.
- It acts as a communication channel between two software applications.
- API is also known as functions in software where it interacts with other applications.
UI Layer: All major testing is done at UI layer.
Business layer: Here all the business logic is carried out here at API testing.
Database Layer: here testing is done using the data base.
What is API?
Like a calculator it performs operations for any two parameters, given the proper instruction of operation.
- In API testing we check for data accuracy.
- It checks for response HTTP status codes.
- It checks for response time.
- It checks for error codes.
- It checks for non functional testing aspects like security tests, checks the accessibility of calculator by others, authentication process and among others.
What is API testing?
API testing is nothing but testing the Application Programming Interfaces (APIs) that ensures
- APIs functions (both input and output of an API ) works correctly as per the requirement specifications or user stories
Here’s an example of API testing:
Let’s say you have an Waiter API that accepts the food order from its customer and It sends that request to Kitchen (server) for preparing of the requested food order.
When food is prepared in Kitchen, Waiter API response to the customer with ordered food
In this context If customer orders (requests) for Burger, then you should get the response (ordered food from waiter the Burger only not any other food
You could test the Waiter API’s functionality by verifying that it works with different inputs and that it handles different orders cases correctly
Importance of API testing
API testing is very much required for some of the important key reasons
Ensuring functionality
Testing APIs can help identify critical defects that ensuring that APIs function as intended.
Improving performance
APIs are often used in high-volume environments and can be a critical bottleneck in the performance of the application.
Testing can help identify performance issues and bottlenecks, enabling optimization and tuning of the API to improve overall system performance.
Enhancing security
APIs are more vulnerable to attacks such as
- SQL injection
- cross-site scripting,
- and other security threats.
API testing can help identify and prevent such vulnerabilities, ensuring that the API is secure.
Saves time and cost
APIs testing start early because it we can detect the issues early in the game
This helps us tp catch issues before they become more expensive and difficult to fix.
Types of API testing
There are various testing types in API testing Here are some of the common types of API testing:
1.Functional Testing
This Testing verifies that the API functions correctly as per the user stories with all possible input/output scenarios and checks whether the API is returning the expected response.
For example, if you have an API endpoint for creating a new user account, you can test it by sending a request with valid input data and verifying that a new user account is created.
2.Integration Testing
Integration testing verifies how the API interacts with different components of the application or system and whether the data flow is accurate.
For example, you can test the integration between an endpoint that creates a new user account and an endpoint that updates user account information,
First API creating a new user account and then Second API updating its information.
3.Regression Testing
This testing ensures that the API continues to function correctly even after changes are made to the code or application.
It includes retesting the API to identify any issues that may have been introduced during the code changes.
4.End-to-End Testing
This testing ensures to check the entire application flow, including the API.
It ensures that all the components of the application work together as intended and that the user experience is seamless.
5.Load Testing
This Testing checks the performance of the API under various load conditions and whether it meets the performance requirements.
6.Security Testing
This testing verifies the security of the API by identifying and addressing potential vulnerabilities.
It includes checking for SQL injections, cross-site scripting (XSS), and other security vulnerabilities.
7.Error Handling Testing
This testing verifies whether the API returns the correct error messages and handles error scenarios appropriately.
It includes testing for error codes, error messages, and other error scenarios.
Tools for API testing
There are various tools available in API testing such as
1.Postman
- This tool allows you to create and send HTTP requests, view the responses, and test API functionality.
- It also provides features like automated testing, documentation generation, and collaboration tools.
2.SoapUI
- It is an open-source API testing tool that provides various features to test SOAP and REST APIs
- It offers features like automated testing, assertion creation, and test case generation.
3.RestAssured
- It is Java-based library for testing RESTful APIs.
- It provides a range of features for API testing, including automated testing, response validation, and error handling.
4.JMeter
- It is an popular open-source tool for load testing, performance testing, and functional testing of APIs.
- It allows you to simulate high loads on APIs and check their response times and performance.
API Testing Requirements Examples
1.Functional Requirements
An e-commerce website APIs must allow customers to place orders, view order history, and manage their account information.
2.Performance requirements
An e-commerce website API must required to respond to requests within 500 milliseconds and handle a peak load of 1,000 requests per second.
3.Security requirements
An e-Commerce website API must use SSL/TLS encryption, support user authentication and authorization, and prevent SQL injection attacks.
4. Compatibility requirements
An e-commerce website API must required to be compatible with multiple operating systems, and database systems, browsers, mobile devices, screen sizes
API testing v/s UI testing
| API TESTING | UI TESTING |
| It validates the functionality, reliability, performance and security of the interface. | It tests only the functional or user experience aspect of the application. |
| It doesn’t check the look and feel of the application. | Here the look and feel of the application is tested. |
| It works on the business layer | It works on the presentation layer. |
| It sends the input to get the responses to validate against the requirements. | Here the tester’s type or use automation tools to send data. |
| Testing is done between backend or server side of the application. | UI v/s backend |
| API layer allows the robust regression tests that is crucial for continuous testing | Presentation layer allows the better user experience. |
| It checks all the issues not related to UI | It checks only UI related issues. |
| They have their own language and format | They use manual or automated tools. |
| It moves data faster and more effectively. | It consumes a lot of time. |
| Do not need to worry about the changes made in UI since UI is not required hence it is faster. | It requires UI elements to test. |
Login API functionality Testing With Example?
We can test the login functionality with API end points for both authentication and authorization mechanisms
Here’s an example of how to perform API testing for login functionality:
Test case 1 : Verify that valid credentials are accepted(user name and password)
- Send a request to the login endpoint with valid credentials(user name and password).
- Verify that the API returns a successful response code (e.g. 200).
- Verify that the response contains an access token or session ID.
Test case 2 : Verify that invalid credentials are rejected (user name and password).
- Send a request to the login endpoint with invalid credentials.
- Verify that the API returns an error response code (e.g. 401 Unauthorized).
- Verify that the response contains an error message indicating that the credentials were invalid.
Test case 3 : Verify that authentication tokens expire after a certain time
- Login with valid credentials and obtain an authentication token.
- Wait for the token to expire (e.g. one hour).
- Send a request to an authenticated endpoint with the expired token.
- Verify that the API returns an error response code (e.g. 401 Unauthorized).
- Verify that the response contains an error message indicating that the token has expired.