API Testing

API testing verifies that an application's interfaces behave correctly in terms of functionality, contracts, performance, security, and error handling.

It catches issues below the UI layer, runs faster than end-to-end tests, and provides direct confidence in service behavior.

Unit tests isolate small pieces of logic, integration tests verify components working together, and API tests validate behavior at the service boundary.

A contract describes the expected structure and behavior of requests and responses, including fields, types, and status codes.

Status codes communicate success, failure, and semantics to clients, so incorrect codes can break integrations even when payloads look reasonable.

A happy-path test verifies the expected success scenario when valid input is provided under normal conditions.

A negative test verifies the API fails correctly when input is invalid, unauthorized, malformed, or otherwise outside the supported path.

A response can return the right status code but still break clients if required fields are missing or typed incorrectly.

An operation is idempotent if repeating the same request produces the same effect as sending it once.

Retries happen in real systems, so idempotent endpoints reduce duplicate side effects when clients or networks fail.

Authentication testing checks whether the API properly identifies the caller using credentials like tokens, sessions, or API keys.

Authorization testing checks whether an authenticated caller is allowed to access a resource or perform an action.