API Testing Practice Exam — LearnCoachAssist

Question 1 API Testing

What is the role of an API client library in testing?

A typed wrapper around HTTP calls (e.g. generated from OpenAPI) that makes tests more readable, IDE-friendly, and refactor-safe compared to raw HTTP calls with hand-built payloads. With credentials, browsers require a specific origin (not *) to prevent leaking the user's session to arbitrary sites. It verifies that the full request path, persistence, and downstream effects all match the intended API behavior. A smoke test is a lightweight check that core endpoints are reachable and functioning after a deployment.

Question 2 API Testing

What is canary deployment?

A PATCH format defined by RFC 6902 that describes a sequence of operations (add, remove, replace, move, copy, test) against a JSON document. An API vulnerability where the server fails to verify that the authenticated user is allowed to access the specific object ID they are requesting — e.g. GET /orders/123 returns any user's order. Testing at the edges of valid input ranges (min, min-1, max, max+1, empty, one) where off-by-one errors and validation oversights are most likely. Rolling out a new API version to a small subset of traffic first, monitoring for regressions, and gradually increasing the share — limiting blast radius if something goes wrong.

Question 3 API Testing

What is equivalence partitioning in API test design?

Grouping inputs into classes that should be treated the same way (e.g. valid emails, invalid emails, empty strings) and picking representative values from each class to keep the test set small but thorough. Cross-Site Request Forgery tricks a browser into sending a request with the victim's cookies attached. APIs that rely on session cookies must defend against it (CSRF tokens, SameSite cookies, custom headers). OpenAPI describes the API as a whole (paths, operations, parameters, security); JSON Schema describes the shape of a single JSON document. OpenAPI reuses JSON Schema for request/response bodies. 4xx — client errors (e.g. 401, 403, 404) signal the caller did something wrong and must adjust.

Question 4 API Testing

What is observability in API testing?

Test isolation means one test should not depend on the execution order or side effects of another test. Observability is the ability to inspect logs, metrics, traces, and responses well enough to debug failures quickly. A precondition header (e.g. If-Match, If-Unmodified-Since) evaluated to false, so the server will not perform the request. It verifies that the full request path, persistence, and downstream effects all match the intended API behavior.

Question 5 API Testing

What is OAuth 2.0 in one sentence?

An authorization framework where a client obtains a delegated access token from an authorization server, then uses it to call a resource server on behalf of a resource owner. Browser-based clients are blocked by CORS unless the server advertises which origins, methods, and headers it allows; tests should confirm the Access-Control-Allow-* headers expose the intended policy. A PATCH format defined by RFC 6902 that describes a sequence of operations (add, remove, replace, move, copy, test) against a JSON document. It tells caches which request headers (e.g. Accept, Accept-Encoding, Origin) the response depends on, so caches don't serve wrong variants to later clients.

Question 6 API Testing

What is idempotency?

Authentication testing checks whether the API properly identifies the caller using credentials like tokens, sessions, or API keys. An operation is idempotent if repeating the same request produces the same effect as sending it once. It catches issues below the UI layer, runs faster than end-to-end tests, and provides direct confidence in service behavior. The command-line runner for Postman collections, useful in CI to execute API test suites headlessly and produce reports.

Question 7 API Testing

What is a N+1 query problem in API backends?

The practice of running API tests as early as possible — in CI on every commit, in pre-commit hooks, or in local dev — to catch defects long before production. It validates that a provider continues to satisfy the expectations of specific consuming clients. When a single API response triggers one DB query per item (often due to a loop fetching related rows), causing performance to degrade linearly with result size. Fix with eager loading / batched fetchers. An API vulnerability where the server fails to verify that the authenticated user is allowed to access the specific object ID they are requesting — e.g. GET /orders/123 returns any user's order.

Question 8 API Testing

What is schema validation?

Schema validation checks whether a request or response matches an agreed structure such as JSON Schema or OpenAPI definitions. The caller is authenticated but is not permitted to access this resource, even with valid credentials. When an API fails to restrict access to privileged endpoints (e.g. an /admin route) based on the caller's role. Meaningful errors help clients recover quickly and reduce support burden when integrations fail.

Question 9 API Testing

What is Newman?

The command-line runner for Postman collections, useful in CI to execute API test suites headlessly and produce reports. Measuring how an API behaves under expected and peak load (concurrent users, requests/sec) to confirm latency, throughput, and error rates stay within targets. 401 means who are you? (no/invalid auth); 403 means I know who you are, but you can't have it (insufficient permission). The server successfully processed the request and is intentionally returning an empty body — clients must not expect a payload.

Question 10 API Testing

What is a provider vs. a consumer in Pact?

The consumer is the service that calls another API (it defines the contract); the provider is the service that exposes the API (it must satisfy all consumer pacts). Loading a known dataset (via SQL, factories, or API calls) into the test environment before tests run, so assertions are made against predictable values. A query that nests fields many layers deep (e.g. user → friends → friends → ...) causing exponential work on the server; defenses include depth limits and query cost analysis. Status codes communicate success, failure, and semantics to clients, so incorrect codes can break integrations even when payloads look reasonable.

Question 11 API Testing

What makes an API test suite valuable long term?

Sending duplicate parameters (e.g. ?id=1&id=2) or unexpected combinations to see if the server picks a value inconsistently, leaks info, or behaves unpredictably. Liveness asks "is the process alive?" — restart if not. Readiness asks "should I receive traffic right now?" — remove from the load balancer if not (e.g. warming up, dependencies down). A flaky API test passes and fails unpredictably due to timing, shared state, or unstable dependencies. It stays fast, readable, isolated, and closely tied to the behaviors clients actually depend on.

Question 12 API Testing

What is the SSRF risk with cloud metadata endpoints?

Cloud providers expose instance metadata at well-known IPs (e.g. 169.254.169.254 for AWS). If an API fetches a user-supplied URL without restrictions, attackers can read IAM credentials from the metadata service. Pushing an API beyond normal capacity to find its breaking point, surface resource leaks, and observe how it fails (gracefully or catastrophically). A quantified reliability target, e.g. "99.9% of requests succeed with p99 latency under 300ms over a 30-day window" — used to gate releases and trigger alerts. Verifying that a provider service's API matches the expectations of its consumers (request/response shape, status codes, headers) — typically via a tool like Pact running as part of both sides' CI.

Question 13 API Testing

What is Broken Object Level Authorization (BOLA)?

An API vulnerability where the server fails to verify that the authenticated user is allowed to access the specific object ID they are requesting — e.g. GET /orders/123 returns any user's order. They are percentiles: p50 is the median, p95 is the worst-case for 95% of requests, p99 is the worst-case for 99%. p95/p99 matter more than averages for tail-latency SLOs. Status codes communicate success, failure, and semantics to clients, so incorrect codes can break integrations even when payloads look reasonable. Authorization testing checks whether an authenticated caller is allowed to access a resource or perform an action.

Question 14 API Testing

What is authorization testing?

Authorization testing checks whether an authenticated caller is allowed to access a resource or perform an action. A technique that follows a single request across multiple services, correlating spans (timed operations) by a shared trace ID to debug latency and failures end-to-end. The process of checking that an incoming request meets the contract: required fields present, types correct, values within allowed ranges, and business rules satisfied, before any business logic runs. A smoke test is a lightweight check that core endpoints are reachable and functioning after a deployment.

Question 15 API Testing

What is optimistic concurrency control in an API?

A feature of Postman that serves a mock implementation of an API based on a saved collection/example responses, useful for parallelizing client and server work. Clients depend on headers like content type, caching, and auth metadata for correct behavior. Sending random, malformed, or unexpected inputs (long strings, binary data, unicode edge cases, negative numbers) to discover crashes, validation gaps, and unhandled exceptions. A pattern where the client sends an If-Match ETag with a write request; the server rejects with 412 Precondition Failed if the resource has changed since the client read it.

Question 16 API Testing

What is distributed tracing in API testing?

Integration tests call the API and may exercise the database or one downstream service; E2E tests exercise the full stack including the UI, real third-party APIs, and live infrastructure. A technique that follows a single request across multiple services, correlating spans (timed operations) by a shared trace ID to debug latency and failures end-to-end. Status codes communicate success, failure, and semantics to clients, so incorrect codes can break integrations even when payloads look reasonable. A lightweight server that simulates a real API's responses, allowing client teams to develop and test against a stable, controllable fake without waiting for the real backend.

Question 17 API Testing

What is JSON Patch (`application/json-patch+json`)?

An API vulnerability where the server fails to verify that the authenticated user is allowed to access the specific object ID they are requesting — e.g. GET /orders/123 returns any user's order. Meaningful errors help clients recover quickly and reduce support burden when integrations fail. A typed wrapper around HTTP calls (e.g. generated from OpenAPI) that makes tests more readable, IDE-friendly, and refactor-safe compared to raw HTTP calls with hand-built payloads. A PATCH format defined by RFC 6902 that describes a sequence of operations (add, remove, replace, move, copy, test) against a JSON document.

Question 18 API Testing

What does p50, p95, and p99 latency mean?

Observability is the ability to inspect logs, metrics, traces, and responses well enough to debug failures quickly. They are percentiles: p50 is the median, p95 is the worst-case for 95% of requests, p99 is the worst-case for 99%. p95/p99 matter more than averages for tail-latency SLOs. The caller is authenticated but is not permitted to access this resource, even with valid credentials. At least type (URI identifying the problem), title, status, and detail; optionally instance (the specific occurrence URI).

Question 19 API Testing

What is a contract drift problem?

Contract drift happens when the actual API behavior slowly diverges from its documented or expected interface. The resource has not changed since the client's cached version; the client should reuse its local copy. Triggered by If-None-Match / If-Modified-Since. Simulating the behavior of components that are unavailable, slow, or shared (databases, third-party APIs, mainframes) so dependent services can be tested in isolation. A compact, signed (and optionally encrypted) token format with three base64url-encoded parts: header, payload (claims), and signature. Self-contained but not automatically revocable.

Question 20 API Testing

Why should APIs return meaningful error messages?

Meaningful errors help clients recover quickly and reduce support burden when integrations fail. The server successfully processed the request and is intentionally returning an empty body — clients must not expect a payload. The request lacks valid authentication credentials; the client should authenticate and retry. -X POST forces the method to POST; -d sends body data and implicitly switches to POST (but does not automatically set Content-Type). Prefer -d with -H 'Content-Type: ...'.

Question 21 API Testing

What is the difference between SLO and SLA?

Gating new API behavior behind a flag so tests can exercise both old and new paths in production, and rollouts/rollbacks happen via configuration without redeploy. Edge cases such as empty payloads, large inputs, missing fields, and duplicate requests are common sources of production bugs. An SLO is an internal target for the team; an SLA is a contractual commitment to customers that often carries financial consequences if missed. When a backend binds client-supplied fields directly to a model without filtering, allowing attackers to set fields they shouldn't control (e.g. is_admin=true in a profile-update body).

Question 22 API Testing

Why mock external services in API tests?

A pattern where the client sends an If-Match ETag with a write request; the server rejects with 412 Precondition Failed if the resource has changed since the client read it. Subjecting an API to sudden, short bursts of high traffic to verify it recovers gracefully and doesn't permanently break when the spike subsides. Mocking reduces flakiness, speeds up runs, and makes failure causes clearer when external dependencies are unreliable or expensive. It stays fast, readable, isolated, and closely tied to the behaviors clients actually depend on.

Question 23 API Testing

What is breakpoint testing?

An HTTP method is safe if it is intended to be read-only and must not cause side effects or modify server state (e.g. GET, HEAD). Incrementally increasing load until the system fails, used to determine the actual maximum capacity rather than a theoretical one. Client–server, stateless, cacheable, uniform interface, layered system, and (optionally) code-on-demand. A smoke test is a lightweight check that core endpoints are reachable and functioning after a deployment.

Question 24 API Testing

What is the difference between liveness and readiness probes?

OpenAPI describes the API as a whole (paths, operations, parameters, security); JSON Schema describes the shape of a single JSON document. OpenAPI reuses JSON Schema for request/response bodies. A PATCH format defined by RFC 6902 that describes a sequence of operations (add, remove, replace, move, copy, test) against a JSON document. Liveness asks "is the process alive?" — restart if not. Readiness asks "should I receive traffic right now?" — remove from the load balancer if not (e.g. warming up, dependencies down). A typed wrapper around HTTP calls (e.g. generated from OpenAPI) that makes tests more readable, IDE-friendly, and refactor-safe compared to raw HTTP calls with hand-built payloads.

Question 25 API Testing

What are the key CORS response headers?

It is a testing approach where consumers define the API expectations they rely on, and providers verify those expectations continuously. Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Allow-Credentials, and Access-Control-Max-Age. 4xx — client errors (e.g. 401, 403, 404) signal the caller did something wrong and must adjust. Rolling out a new API version to a small subset of traffic first, monitoring for regressions, and gradually increasing the share — limiting blast radius if something goes wrong.

Question 26 API Testing

What is a smoke test for an API?

Libraries that assert an API response matches an expected JSON shape — either as a full schema (JSON Schema) or as a strict subset of expected fields/values. A lightweight endpoint (often GET /health or /healthz) that returns the service's liveness/readiness status, used by load balancers, orchestrators, and post-deploy tests. A smoke test is a lightweight check that core endpoints are reachable and functioning after a deployment. A user-friendly command-line HTTP client that emphasizes readable syntax, colorized output, and built-in JSON support — often used as a more humane alternative to curl.

Question 27 API Testing

What is an end-to-end contract check?

It verifies that the full request path, persistence, and downstream effects all match the intended API behavior. Regression testing ensures previously working behavior still works after code changes. With credentials, browsers require a specific origin (not *) to prevent leaking the user's session to arbitrary sites. A negative test verifies the API fails correctly when input is invalid, unauthorized, malformed, or otherwise outside the supported path.

Question 28 API Testing

What is the difference between OpenAPI and JSON Schema?

OpenAPI describes the API as a whole (paths, operations, parameters, security); JSON Schema describes the shape of a single JSON document. OpenAPI reuses JSON Schema for request/response bodies. Schema validation checks whether a request or response matches an agreed structure such as JSON Schema or OpenAPI definitions. A command-line tool for transferring data with URLs. It is invaluable for quick API probing, reproducing bugs, and scripting HTTP calls without a full test framework. A release strategy where a new version (green) is deployed alongside the old (blue); traffic is switched atomically, and the old version is kept warm for instant rollback.

Question 29 API Testing

What is test data seeding?

Rolling out a new API version to a small subset of traffic first, monitoring for regressions, and gradually increasing the share — limiting blast radius if something goes wrong. They are percentiles: p50 is the median, p95 is the worst-case for 95% of requests, p99 is the worst-case for 99%. p95/p99 matter more than averages for tail-latency SLOs. The resource has not changed since the client's cached version; the client should reuse its local copy. Triggered by If-None-Match / If-Modified-Since. Loading a known dataset (via SQL, factories, or API calls) into the test environment before tests run, so assertions are made against predictable values.

Question 30 API Testing

What is a key testing concern unique to GraphQL APIs?

You must test for query complexity, depth limiting, and field-level authorization — because a single endpoint can return many resources, a malicious or naive query can otherwise exfiltrate data or DoS the server. An automated stage in continuous integration that runs the API test suite on every commit/PR, gates merges on green, and reports results (often in GitHub Actions, GitLab CI, Jenkins, etc.). GET, HEAD, PUT, DELETE, and (practically) OPTIONS and TRACE — repeated identical calls leave the server in the same state. Mocking reduces flakiness, speeds up runs, and makes failure causes clearer when external dependencies are unreliable or expensive.

Question 31 API Testing

What is request validation at the API layer?

A consumer-driven contract testing tool where consumers record their expectations (a "pact") and providers verify against it, enabling safe independent deployments of microservices. An HTTP method is safe if it is intended to be read-only and must not cause side effects or modify server state (e.g. GET, HEAD). The process of checking that an incoming request meets the contract: required fields present, types correct, values within allowed ranges, and business rules satisfied, before any business logic runs. Data setup is the creation of predictable preconditions so the test can run reliably and assert meaningful outcomes.

Question 32 API Testing

What is the difference between PUT and PATCH?

PUT replaces the entire resource with the submitted representation; PATCH applies a partial change to specific fields. Meaningful errors help clients recover quickly and reduce support burden when integrations fail. A technique that follows a single request across multiple services, correlating spans (timed operations) by a shared trace ID to debug latency and failures end-to-end. A single unit of work within a trace, with a name, start/end time, attributes (e.g. http.status_code), and a parent span ID — typically following the OpenTelemetry data model.

Question 33 API Testing

What claim in a JWT indicates when the token expires?

The exp (expiration time) claim — a numeric date representing seconds since the Unix epoch. A helper that generates valid, randomized test objects (e.g. a UserFactory building a user with a random name and email) so each test gets fresh, isolated data. Browser-based clients are blocked by CORS unless the server advertises which origins, methods, and headers it allows; tests should confirm the Access-Control-Allow-* headers expose the intended policy. Basic sends base64(username:password) on every request (trivially decoded); Digest uses a challenge/response hash so the password is never sent on the wire.

Question 34 API Testing

Why should API tests validate response shape?

The request lacks valid authentication credentials; the client should authenticate and retry. An attacker tricks the server into making an HTTP request to an unintended destination (internal service, cloud metadata URL like 169.254.169.254) via a parameter the server fetches. They are percentiles: p50 is the median, p95 is the worst-case for 95% of requests, p99 is the worst-case for 99%. p95/p99 matter more than averages for tail-latency SLOs. A response can return the right status code but still break clients if required fields are missing or typed incorrectly.

Question 35 API Testing

What is code coverage vs. API coverage?

An automated stage in continuous integration that runs the API test suite on every commit/PR, gates merges on green, and reports results (often in GitHub Actions, GitLab CI, Jenkins, etc.). Grouping inputs into classes that should be treated the same way (e.g. valid emails, invalid emails, empty strings) and picking representative values from each class to keep the test set small but thorough. A lightweight endpoint (often GET /health or /healthz) that returns the service's liveness/readiness status, used by load balancers, orchestrators, and post-deploy tests. Code coverage measures executed lines/branches in the implementation; API coverage measures which endpoints, status codes, and parameter combinations have been tested at the HTTP boundary.

Question 36 API Testing

Which HTTP methods are defined as idempotent by RFC 7231?

A single unit of work within a trace, with a name, start/end time, attributes (e.g. http.status_code), and a parent span ID — typically following the OpenTelemetry data model. GET, HEAD, PUT, DELETE, and (practically) OPTIONS and TRACE — repeated identical calls leave the server in the same state. API testing verifies that an application's interfaces behave correctly in terms of functionality, contracts, performance, security, and error handling. The client has exceeded the rate limit; it should slow down, typically honoring a Retry-After header.

Question 37 API Testing

What is authentication testing?

With credentials, browsers require a specific origin (not *) to prevent leaking the user's session to arbitrary sites. Authentication testing checks whether the API properly identifies the caller using credentials like tokens, sessions, or API keys. A BDD-flavored test structure: Given a precondition, When an action occurs, Then an outcome is expected — useful for readable, behavior-focused API tests. A tool that records real HTTP traffic and replays it as a virtual service, letting tests run against a captured likeness of upstream APIs without hitting the real dependency.

Question 38 API Testing

What is shift-left testing for APIs?

The practice of running API tests as early as possible — in CI on every commit, in pre-commit hooks, or in local dev — to catch defects long before production. The resource has not changed since the client's cached version; the client should reuse its local copy. Triggered by If-None-Match / If-Modified-Since. A dedicated, isolated environment that mirrors production closely enough to safely run integration and E2E tests without affecting real users or data. Header (algorithm and token type), Payload (claims such as sub, exp, iss), and Signature (verifying the token was not tampered with).

Question 39 API Testing

What is the difference between a mock and a stub?

Contract drift happens when the actual API behavior slowly diverges from its documented or expected interface. Call a few critical endpoints, verify expected status codes and payload keys, and confirm latency stays within an acceptable range. A stub returns canned responses to specific calls; a mock also verifies expectations (e.g. "this method was called once with these args"). In API testing, the terms are often used interchangeably. A consumer-driven contract testing tool where consumers record their expectations (a "pact") and providers verify against it, enabling safe independent deployments of microservices.

Question 40 API Testing

What is soak testing?

Subjecting an API to sudden, short bursts of high traffic to verify it recovers gracefully and doesn't permanently break when the spike subsides. Running an API at moderate load for an extended period (hours/days) to detect slow leaks: memory growth, file handle exhaustion, connection pool saturation, and slow performance drift. A community-maintained list of the most critical API security risks, currently including Broken Object Level Authorization (BOLA), Broken Authentication, Excessive Data Exposure, Lack of Resources & Rate Limiting, and others. A response header sent with 401 that tells the client which authentication scheme is required (e.g. Bearer, Basic) and any associated parameters.

Question 41 API Testing

What is Mass Assignment vulnerability?

When a backend binds client-supplied fields directly to a model without filtering, allowing attackers to set fields they shouldn't control (e.g. is_admin=true in a profile-update body). Simulating the behavior of components that are unavailable, slow, or shared (databases, third-party APIs, mainframes) so dependent services can be tested in isolation. A response header sent with 401 that tells the client which authentication scheme is required (e.g. Bearer, Basic) and any associated parameters. A technique that follows a single request across multiple services, correlating spans (timed operations) by a shared trace ID to debug latency and failures end-to-end.

Question 42 API Testing

What is test coverage for an API?

A measure of how much of the API surface (endpoints, status codes, parameter combinations, response branches) is exercised by automated tests — usually expressed as a percentage of lines, branches, or operations. An operation is idempotent if repeating the same request produces the same effect as sending it once. An architectural style for networked APIs centered on resources identified by URIs, uniform interfaces, stateless requests, and representations (often JSON) transferred over HTTP. Incrementally increasing load until the system fails, used to determine the actual maximum capacity rather than a theoretical one.

Question 43 API Testing

What is the test trophy (Kent C. Dodds) variation?

A technique that follows a single request across multiple services, correlating spans (timed operations) by a shared trace ID to debug latency and failures end-to-end. Emphasizes static typing and integration tests over pure unit tests, putting more weight on API/integration tests because they catch more real-world bugs with less maintenance. GET, HEAD, PUT, DELETE, and (practically) OPTIONS and TRACE — repeated identical calls leave the server in the same state. It tells caches which request headers (e.g. Accept, Accept-Encoding, Origin) the response depends on, so caches don't serve wrong variants to later clients.

Question 44 API Testing

What is a Bearer token in API authentication?

Retries can hide real instability if they are used to mask problems instead of diagnosing them. An opaque access token sent in the Authorization: Bearer <token> header; possession of the token is sufficient to authenticate the caller. Rate limiting protects systems from abuse and noisy clients, so tests should verify limits are enforced and communicated clearly. The client has exceeded the rate limit; it should slow down, typically honoring a Retry-After header.

Question 45 API Testing

What is the difference between Basic and Digest authentication?

Test isolation means one test should not depend on the execution order or side effects of another test. A single unit of work within a trace, with a name, start/end time, attributes (e.g. http.status_code), and a parent span ID — typically following the OpenTelemetry data model. Basic sends base64(username:password) on every request (trivially decoded); Digest uses a challenge/response hash so the password is never sent on the wire. An automated stage in continuous integration that runs the API test suite on every commit/PR, gates merges on green, and reports results (often in GitHub Actions, GitLab CI, Jenkins, etc.).

Question 46 API Testing

What does HTTP 403 Forbidden actually communicate?

API testing verifies that an application's interfaces behave correctly in terms of functionality, contracts, performance, security, and error handling. A new resource was created; the response should include a Location header pointing to the new resource. A response header sent with 401 that tells the client which authentication scheme is required (e.g. Bearer, Basic) and any associated parameters. The caller is authenticated but is not permitted to access this resource, even with valid credentials.

Question 47 API Testing

What is the difference between `curl -X POST` and `curl -d '...'`?

-X POST forces the method to POST; -d sends body data and implicitly switches to POST (but does not automatically set Content-Type). Prefer -d with -H 'Content-Type: ...'. It gives clients a canonical URI for the newly created resource so they can fetch or reference it without guessing. 404 means the resource is not found at this URI (and may exist elsewhere or later); 410 means the resource existed but has been permanently removed. They should catch regressions without failing simply because environments vary slightly across runs.

Question 48 API Testing

What is load testing?

An operation is idempotent if repeating the same request produces the same effect as sending it once. Basic sends base64(username:password) on every request (trivially decoded); Digest uses a challenge/response hash so the password is never sent on the wire. A model: many unit tests at the bottom, a moderate number of integration/API tests in the middle, and a small number of end-to-end tests at the top — balancing speed, cost, and confidence. Measuring how an API behaves under expected and peak load (concurrent users, requests/sec) to confirm latency, throughput, and error rates stay within targets.

Question 49 API Testing

Why should JWTs generally be signed, not just encoded?

Encoding is reversible; a signature lets the receiver verify the token was issued by a trusted party and its claims were not altered in transit. Authentication testing checks whether the API properly identifies the caller using credentials like tokens, sessions, or API keys. Pushing an API beyond normal capacity to find its breaking point, surface resource leaks, and observe how it fails (gracefully or catastrophically). A machine-readable specification (YAML/JSON) describing an API's endpoints, parameters, request/response schemas, auth, and errors — enabling docs, codegen, and contract testing.

Question 50 API Testing

What is Broken Function Level Authorization?

Code coverage measures executed lines/branches in the implementation; API coverage measures which endpoints, status codes, and parameter combinations have been tested at the HTTP boundary. A precondition header (e.g. If-Match, If-Unmodified-Since) evaluated to false, so the server will not perform the request. Incrementally increasing load until the system fails, used to determine the actual maximum capacity rather than a theoretical one. When an API fails to restrict access to privileged endpoints (e.g. an /admin route) based on the caller's role.