Here are my
API Testing Questions and Answers for
SDETs, QA and Manual Testers. Read the interview questions on API Testing fundamentals, what to test in API Testing, writing effective API Test Cases, API Testing types, API Testing tools and Examples of API Test Cases.
If you want my complete set of API Testing Interview Questions and Answers as a document that additionally contain the following topics, you can message
me on my
LinkedIn profile or send me a message in the Contact Us form in the right pane:
API Testing with Postman, API Testing with SoapUI, API Testing with REST Assured, API Testing challenges and solutions, API Testing error codes, advanced API Testing techniques, and Interview Preparation Questions and Answers, with tips.
Question: What’s API testing, and why is it important?
Answer: API testing means testing Application Programming Interfaces (APIs) to test if they work as expected, meet performance standards, and handle errors. APIs handle the communication between software systems, enabling them to exchange data and functionality. API testing is important for the following reasons:
- Logic Validation: APIs can encapsulate the core business logic of an application. API testing finds out if that logic works as intended.
- Cascading Effect Prevention: Since APIs often connect multiple systems, a failure in one API can disrupt the entire system. For example, in an e-commerce system, if the API managing payment processing fails, it can prevent order confirmations and impact inventory updates, customer notifications, and financial records.
- Integration Validation: APIs handle the interactions between different systems. Testing these interactions for correctness, reliability, performance and security is critical.
- Early Bug Detection: By testing APIs before the UI is complete, defects can be identified earlier, reducing downstream issues.
Question: What’s the primary focus of API testing?
Answer: The primary focus areas include:
- Functionality: Testing if the API executes intended operations and returns accurate responses. Example: A "getUserDetails" API should return the correct user details based on the provided user ID.
- Performance: Validating the API’s speed and responsiveness under varying loads. Example: Testing if the API responds within 300 ms when handling 100 simultaneous requests.
- Security: Checking data protection, authentication, and authorization mechanisms. Example: Ensuring unauthorized users cannot access restricted endpoints.
- Reliability: Confirming if the API delivers consistent results across multiple calls and scenarios. Example: A weather API should always return the correct temperature for a given city.
Question: Is API testing considered functional or non-functional testing type?
Answer: API testing is often regarded as functional but also includes non-functional tests (performance, security, etc.). The objective of API testing is to validate if the API performs its expected functions accurately. API testing also involves non-functional testing types, depending on the test scope:
- Performance Testing: To measure the API’s responsiveness and stability under different conditions. Example: Load testing an API that handles ticket booking during a flash sale.
- Security Testing: To validate data confidentiality and access control mechanisms. Example: Testing an API for vulnerabilities like SQL injection or unauthorized access.
Question: How does API testing differ from UI testing?
Answer: API testing focuses on the backend logic, while UI testing validates the user interface. Their differences include:
API Testing vs UI Testing
- Scope: Validates backend systems and business logic vs Tests user interface interactions.
- Speed: Faster since it bypasses the graphical interface vs Slower due to rendering processes;
- Reliability: API tests are more stable; less prone to flaky results caused by UI changes vs Prone to instability if UI elements change.
Example: API example - Verifying a "createOrder" API works correctly. UI example - Testing if the "Place Order" button functions properly.
Question: Does API testing come under integration testing or system testing test levels?
Answer: API testing is considered a part of integration testing because it validates how different components or systems interact with each other.
Example: Testing an API that bridges a payment gateway with an e-commerce platform: The focus would be on testing the correct and complete communication, accurate data exchange, and correct handling of alternate workflows like declined payments.
Question: Can API testing also fall under system testing test level?
Answer: Yes, API testing can be a part of system testing when it is used to validate end-to-end workflows that involve APIs.
Example: An order management system involves several APIs for inventory, payment, and customer notification. System testing would involve validating the entire order placement process, including all the APIs in the workflow.
Question: Why is classifying API testing important?
Answer: Classifying API testing determines the test scope and test approach for testing.
Answer: For example:
- For integration testing, focus on inter-component communication.
- For system testing, test the APIs as part of larger workflows to ensure end-to-end functionality.
Question: What are the key concepts in API testing that you know as an SDET, QA or manual tester?
Answer: API testing has the following key concepts:
-
Endpoints: Endpoints are the URLs where APIs are accessed.
Example: A weather API endpoint might look like
https://api.weather.com/v1/city/temperature.
Tip: You should always document endpoints clearly, including required parameters and response formats.
-
Requests and Methods: APIs use HTTP methods to perform operations. The common ones are:
1.
GET: Retrieve data.
Example: Fetching user details with GET /user/{id}.
2.
POST: Create new data.
Example: Creating a new user with POST /user.
3.
PUT: Update existing data.
Note: that PUT may also be used to create-or-replace resources depending on API design. Example: Updating user details with PUT /user/{id}.
4.
DELETE: Remove data.
Example: Deleting a user with DELETE /user/{id}. Tip: Verify that the API strictly adheres to the HTTP method conventions.
Request Payloads and Parameters
APIs often require input parameters or payloads to function correctly:
1. Query Parameters: Added to the URL (e.g., ?userId=123).
2. Body Parameters: Sent in the request body (e.g., JSON payload for POST requests).
Tip: Validate edge cases for parameters, such as missing, invalid, or boundary values.
Responses and Status Codes
API responses include data and status codes. Design tests for all possible response scenarios, including success, error, and unexpected responses. Common status codes are:
1. 200 OK: Successful request.
2. 201 Created: Resource successfully created.
3. 204 No Content
4. 400 Bad Request: Client-side error.
5. 401 Unauthorized: Missing or invalid authentication.
6. 403 Forbidden
7. 404 Not Found
8. 429 Too Many Requests
9. 500 Internal Server Error: API failure.
Headers and AssertionsHeaders carry metadata such as authentication tokens, content type, and caching information.
Example: Authorization: Bearer <token> for authenticated APIs. Tip: Always validate headers for correctness and completeness.
Assertions validate the API's behavior by checking:
1.
Response Status Codes: Validate if the expected codes are returned.
2.
Response Body: Validate if the response data matches the expected format and content.
3.
Performance: Measure if the API responds within acceptable time limits.
Tip: Use libraries like
REST Assured or
Postman to implement assertions quickly.
Question: Why is API testing important in modern software development?
Answer: Modern software relies heavily on APIs for communication, making their reliability paramount:
-
APIs Drive Application Functionality: APIs implement the key features of applications, like user authentication, data retrieval, and payment processing.
Example: A banking app’s core functionalities, such as checking account balances, transferring funds, and viewing transaction history, are implemented with APIs.
-
Integration Testing: APIs connect multiple systems. Ensuring their proper integration prevents cascading failures.
Example: In a ride-sharing app, APIs for user location, driver availability, and payment must work together correctly.
-
Early Testing Opportunity: APIs can be tested as soon as they are developed, even before the UI is ready.
Example: Testing an e-commerce app’s POST /addToCart API before the cart UI is finalized.
-
Microservices Architecture: Applications are composed of multiple independent services connected via APIs.
Example: A video streaming platform might use separate APIs for authentication, video delivery, and recommendation engines.
-
Scalability and Performance Assurance: APIs must be able to handle high traffic and large datasets efficiently.
Example: During a Black Friday sale, an e-commerce platform’s APIs must manage thousands of concurrent users adding items to their carts.
-
Cost Efficiency: API issues identified early are cheaper to fix than UI-related defects discovered later.
Tips and Tricks for Testers:
- Use Mock Servers: Mock APIs allow you to test scenarios without using the ready APIs.
- Validate Negative Scenarios: Don’t just test happy paths; additionally test invalid inputs, unauthorized access, and server downtime.
- Automate Tests: Automating repetitive API tests saves time for test coverage. Tools like REST Assured and Postman can help you automate validations for different test scenarios.
Note: You can follow me in LinkedIn for more practical information in Test Automation and Software Testing at the link,
https://www.linkedin.com/in/inderpsingh
Question: How do you conduct functional testing of APIs?
Answer: Functional testing tests if the API performs its intended operations accurately and consistently. It includes the following tests:
- Endpoint Validation: Validate if the API endpoints respond to requests as expected. Example: Testing if the GET /user/{id} endpoint retrieves the correct user details for a given ID.
- Input Validation: Test how the API handles various input scenarios:
o Valid inputs.
o Invalid inputs (e.g., incorrect data types or missing required fields).
o Boundary values (e.g., maximum or minimum allowable input sizes). Example: Testing an API that accepts a date range to ensure it rejects malformed dates like 32-13-2025.
- Business Logic Testing: Validate that the API implements the defined business rules correctly and completely. Example: For an e-commerce API, ensure the POST /applyCoupon endpoint allows discounts only on eligible products.
- Dependency Validation: Test how APIs interact with other services. Example: If an API triggers a payment gateway, test if the API handles responses like success, failure, and timeout correctly.
Tip: Use tools like Postman to design and execute functional test cases effectively. Automate repetitive tests with libraries like REST Assured for scalability.
Question: What do you validate in API responses?
Answer: Validating API responses involves validating the accuracy, structure, and completeness of the data returned by the API.
- Status Codes: Confirm that the correct HTTP status codes are returned for each scenario.
o 200 OK: For successful requests.
o 404 Not Found: When the requested resource does not exist.
o 500 Internal Server Error: For server-side failures.
- Response Body: Validate the structure and data types. Example: If the API returns user details, validate if the response contains fields like name, email, and age with the correct types (e.g., string, string, and integer).
- Schema Validation: Check if the API response matches the expected schema. Tip: Use schema validation tools like JSON Schema Validator to automate this process.
- Data Accuracy: Test if the API returns correct and expected data. Example: Testing the GET /product/{id} endpoint to verify that the price field matches the database record for the product.
- Error Messages: Validate that error responses are descriptive, consistent, and secure. Example: If a required parameter is missing, the API should return a clear error like "Error: Missing parameter 'email'".
Tip: Include assertions for all fields in the response to avoid missed validations during regression testing.
Question: How do you perform security testing for APIs?
Answer: Security testing focuses on protecting APIs from unauthorized access, data breaches, and malicious attacks. Key test scenarios include:
-
Authentication and Authorization: Test if the API enforces authentication (e.g., OAuth, API keys). Verify role-based access control (RBAC).
Example: A DELETE /user/{id} endpoint should only be accessible to administrators.
-
Input Sanitization: Check for vulnerabilities like
SQL injection or
cross-site scripting (XSS).
Example: Test input fields by submitting malicious payloads like '; DROP TABLE [Table];-- to confirm if they are sanitized.
Safety Note: Never run destructive payloads against production systems. Do not run destructive payloads against any real database; example is for illustration only. Use safe test beds or intentionally vulnerable labs.
-
Data Encryption: Test that sensitive data is encrypted during transmission (e.g., via HTTPS).
Example: Check if login credentials sent in a POST /login request are transmitted securely over HTTPS.
-
Rate Limiting: Validate that the API enforces rate limits to prevent abuse.
Example: A public API should reject excessive requests from the same IP with a 429 Too Many Requests response.
-
Token Expiry and Revocation: Test how the API handles expired or revoked authentication tokens.
Example: Test that a revoked token results in a 401 Unauthorized response.
Tip: Use tools like OWASP ZAP and Burp Suite to perform comprehensive API security testing.
Question: What aspects of API performance do you test?
Answer: API performance testing evaluates the speed, scalability, and reliability of APIs under various conditions.
-
Response Time: Measure how quickly the API responds to requests.
Example: For a weather API, test if the response time for GET /currentWeather is under 200ms.
-
Load Testing: Test the API's behavior under normal and peak load conditions.
Example: Simulate 100 concurrent users hitting the POST /login endpoint to verify stability.
-
Stress Testing: Determine the API's breaking point by testing it under extreme conditions.
Example: Gradually increase the number of requests to an API until it fails to identify its maximum capacity.
-
Spike Testing: Validate the API’s ability to handle sudden traffic surges.
Example: Simulate a flash sale scenario for an e-commerce API.
-
Resource Usage: Monitor server resource usage (CPU, memory) during API tests.
Example: Confirm that the API doesn’t consume excessive memory during a batch operation like POST /uploadBulkData.
-
Caching Mechanisms: Test if the API effectively uses caching to improve response times.
Example: Validate if frequently requested resources like product images are served from the cache.
Tip: Use tools like
JMeter and Gatling for automated performance testing. Monitor metrics like latency, throughput, and error rates to identify bottlenecks.
Note: In order to expand your professional network and share opportunities with each other, you’re welcome to connect with
me (Inder P Singh) in LinkedIn at
https://www.linkedin.com/in/inderpsingh
Question: What best practices for writing API test cases do you follow?
Answer: Writing effective API test cases needs a methodical approach. Here are some best practices:
- Understand the API Specification: Study the API documentation, including endpoint definitions, request/response formats, and authentication mechanisms. Example: For a GET /user/{id} API, understand its parameters (id), response structure, and expected error codes.
- Identify Test Scenarios: Convert the API’s functionality into testable scenarios:
o Positive test cases: Validate the expected behavior for valid inputs.
o Negative test cases: Test if the API handles invalid inputs gracefully.
o Edge cases: Test boundary values to identify vulnerabilities. Example: For a pagination API, test scenarios include valid page numbers, invalid page numbers (negative values), and boundary values (e.g., maximum allowed page).
- Use a Modular Approach: Create reusable test scripts for common actions like authentication or header validation. Example: Write a reusable function to generate a valid authorization token for secure APIs.
- Use Assertions: Verify key aspects like status codes, response time, response structure, and data accuracy. Example: Assert that the response time for GET /products is under 200ms.
- Automate Wherever Possible: Use tools like REST Assured or Postman to automate test case execution for scalability and efficiency. Example: Automate regression tests for frequently changing APIs to minimize manual effort.
- Prioritize test cases based on business impact and API complexity. High-priority features should have extensive test coverage.
Question: How do you define inputs and expected outputs for API test cases?
Answer:
Inputs:
- Define the parameters required by the API.
o
Mandatory Parameters: Verify that all required fields are provided.
o
Optional Parameters: Test the API behavior when optional parameters are included or excluded.
- Test with various input types:
o Valid inputs: Proper data types and formats.
o Invalid inputs: Incorrect data types, missing fields, and null values.
Example: For a POST /createUser API, inputs may include:
{
"name": "John Doe",
"email": "[email protected]",
"age": 30
}
Expected Outputs:
- Define the expected API responses for various scenarios:
o
Status Codes: Verify that the API returns correct HTTP status codes for each scenario (e.g., 200 for success, 400 for bad request).
o
Response Data: Specify the structure and values of the response body.
o Headers: Verify essential headers like Content-Type and Authorization.
Example: For the POST /createUser API, the expected output for valid inputs might be:
{
"id": 101,
"message": "User created successfully."
}
Question: What’s a well-structured API test case template?
Answer: A structured template enables writing test cases that are complete, reusable, and easy to understand.
Tip: Use tools like
Jira, Excel, or test management software to document and track test cases systematically.
Question: What’s Functional Testing in API testing?
Answer: Functional Testing validates if the API meets its specified functionality and produces the correct output for given inputs. It tests if the API behaves as expected under normal and edge-case scenarios.
Key Aspects to Test:
- Validation of Endpoints: Test that each endpoint performs its intended functionality. Example: A GET /user/{id} API should fetch user details corresponding to the provided ID.
- Input Parameters: Test required, optional, and invalid parameters. Example: For a POST /login API, validate behavior when required parameters like username or password are missing.
- Response Validations: Verify the response codes, headers, and body. Example: Assert that Content-Type is application/json for API responses.
Tips for API Functional Testing:
- Use data-driven testing to validate multiple input combinations.
- Automate functional tests with tools like REST Assured or Postman for efficiency.
Question: What’s API Load Testing?
Answer: Load Testing assesses the API’s performance under normal and high traffic to test if it handles expected user loads without degradation.
Steps to Perform Load Testing:
- Set the Benchmark: According to the API performance requirements, define the expected number of concurrent users or requests per second. Example: An e-commerce API might need to handle 500 concurrent product searches.
- Simulate the Load: Use tools like JMeter or Locust to generate virtual users. Example: Simulate 200 users simultaneously accessing the GET /products endpoint.
- Monitor Performance Metrics: Track response time, throughput, and server resource utilization. Example: Verify that response time stays below 1 second and CPU usage remains under 80%.
Common Issues Identified:
- Slow response times due to inefficient database queries.
- Server crashes under high load.
Tips for Load Testing:
- Test with both expected and peak traffic to prepare for usage spikes.
- Use realistic data to simulate production-like scenarios.
Question: Why is Security Testing important for APIs?
Answer: APIs can be targets for malicious attacks, so Security Testing tests if they are protected against vulnerabilities and unauthorized access.
Important Security Tests:
- Authentication and Authorization: Verify secure implementation of mechanisms like OAuth2 or API keys. Example: Ensure a user with user role cannot access admin-level resources.
- Input Validation: Check for injection vulnerabilities like SQL injection or XML External Entity (XXE) attacks. Example: Test the API with malicious payloads such as "' OR 1=1--".
- Encryption and Data Privacy: Validate that sensitive data is encrypted during transit using HTTPS. Example: Ensure Authorization headers are not logged or exposed.
- Rate Limiting and Throttling: Test whether APIs restrict the number of requests to prevent abuse. Example: A GET /data endpoint should return a 429 Too Many Requests error after exceeding the request limit.
Tip: Use tools like OWASP ZAP and Burp Suite for vulnerability scanning.
Question: What’s Interoperability Testing in API testing?
Answer: Interoperability Testing tests if the API works correctly with other systems, platforms, and applications.
Steps to Perform Interoperability Testing:
-
Validate Protocol Compatibility: Check API compatibility across HTTP/HTTPS, SOAP, or gRPC protocols.
Example: Test that a REST API supports both JSON and XML response formats, if required.
-
Test Integration Scenarios: Test interactions between APIs and third-party services.
Example: Verify that a payment API integrates correctly with a third-party gateway like Stripe.
-
Cross-Platform Testing: Test API accessibility across different operating systems, browsers, or devices.
Example: Verify that the API has consistent behavior when accessed via Windows, Linux, or macOS.
Common Issues:
- Inconsistent response formats between systems.
- Compatibility issues due to different versions of an API.
Tips for Interoperability Testing:
- Use mock servers to simulate third-party APIs during testing.
- Validate response handling for various supported data formats (e.g.,
JSON,
XML).
Question: What’s Contract Testing in API testing?
Answer: Contract Testing tests if the API adheres to agreed-upon specifications between providers (backend developers) and consumers (frontend developers or external systems).
Steps to Perform Contract Testing:
- Define the Contract: Use specifications like OpenAPI (Swagger) to document expected request/response structures.
Example: A GET /users API contract may specify that id is an integer and name is a string.
- Validate Provider Implementation: Verify the API provider adheres to the defined contract.
Example: Verify that all fields in the contract are present in the actual API response.
- Test Consumer Compatibility: Verify that consumers can successfully interact with the API as per the contract.
Example: Check that a frontend application can parse and display data from the API correctly.
Common Tools for Contract Testing:
-
PACT: A widely-used framework for consumer-driven contract testing.
- Postman: For validating API responses against schema definitions.
Tips for Contract Testing:
- Treat contracts as living documents and update them for every API change.
- Automate contract testing in CI/CD pipelines to detect issues early.
In order to stay updated and view the latest tutorials,
subscribe to my
Software and Testing Training channel (341 tutorials) at
https://youtube.com/@QA1
Question: What’s Postman, and why is it popular for API testing?
Answer:
Postman is a powerful API testing tool that has a user-friendly interface for designing, executing, and automating API test cases. It’s widely used because it supports various API types (REST, SOAP, GraphQL) and enables both manual and automated testing.
Features of Postman:
- Collections and Requests: Organize test cases into collections for reusability.
Example: Group all CRUD (meaning Create, Read, Update and Delete) operations (POST, GET, PUT, DELETE) for a user API in a collection.
- Environment Management: Use variables to switch between different environments like development, staging, and production.
Example: Define {{base\_url}} for different environments to avoid hardcoding endpoints.
- Built-in Scripting: Use JavaScript for pre-request and test scripts to validate API responses.
Example: Use assertions like
pm.expect(response.status).to.eql(200);.
- Automated Testing with Newman: Run collections programmatically in CI/CD pipelines using Newman, Postman’s CLI tool.
Few Best Practices for Using Postman:
- Use Version Control: Export and version collections in Git to track changes.
- Use Data-Driven Testing: Use CSV/JSON files for parameterizing tests to cover multiple scenarios.
Example: Test the POST /register API with various user data combinations.
- Automate Documentation: Generate API documentation directly from Postman collections for seamless collaboration.
Question: What’s SoapUI, and how does it differ from Postman?
Answer:
SoapUI is a comprehensive API testing tool designed for SOAP and REST APIs. Unlike Postman, which is more user-friendly, SoapUI provides advanced features for functional, security, and load testing, making it more suitable for complex enterprise-level APIs.
Steps to Get Started with SoapUI:
- Install SoapUI: Download and
install the free version (SoapUI Open Source) or the licensed version (ReadyAPI) for advanced features.
- Create a Project: Import API specifications like WSDL (for SOAP) or OpenAPI (for REST) to create a test project.
Example: Load a WSDL file to test a SOAP-based payment processing API.
- Define Test Steps: Create test cases with multiple steps such as sending requests, validating responses, and chaining steps.
Example: For a login API, test POST /login and validate that the token from the response is used in subsequent API calls.
- Use Assertions: Use built-in assertions for validating response status codes, time, and data.
Example: Check if the <balance> field in a SOAP response equals $1000.
Advanced Features:
-
Data-Driven Testing: Integrate external data sources like Excel or databases.
- Security Testing: Test for vulnerabilities like SQL injection.
- Load Testing: Simulate concurrent users to evaluate API performance.
Best Practices for SoapUI:
- Use
Groovy scripting to create custom logic for complex scenarios.
- Automate test execution by integrating SoapUI with Jenkins or other Continuous Integration (CI) tools.
- Check that WSDL or API specifications are always up to date to avoid testing obsolete APIs.
Question: What’s REST Assured, and why is it preferred by SDETs?
Answer:
REST Assured is a Java library that simplifies writing automated tests for REST APIs. It integrates with popular testing frameworks like
JUnit and
TestNG, making it useful for SDETs familiar with Java.
How to Get Started with REST Assured:
- Set Up REST Assured: Add the REST Assured dependency in your Maven pom.xml or Gradle build file
-
Write Basic Tests: Create a test class and use REST Assured methods to send API requests and validate responses.
Example:
import io.restassured.RestAssured;
import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;
// connect with me in LinkedIn at https://www.linkedin.com/in/inderpsingh
public class ApiTest {
@Test
public void testGetUser() {
given().
baseUri("https://api.example.com").
when().
get("/user/1").
then().
assertThat().
statusCode(200).
body("name", equalTo("John Doe"));
}
}
-
Parameterization: Use dynamic query or path parameters for flexible testing
. Example:
given().
pathParam("id", 1).
when().
get("/user/{id}").
then().
statusCode(200);
-
Chaining Requests: Chain API calls for end-to-end scenarios.
Example: Use the token from a login response in subsequent calls.
Why Use REST Assured? - Combines test case logic and execution in a single programming environment.
- Provides support for validations, including JSON and XML paths.
- Simplifies testing for authentication mechanisms like OAuth2, Basic Auth, etc.
Best Practices for REST Assured:
- Follow Framework Design Principles: Integrate REST Assured into a test automation framework for reusability and scalability. Use Page Object Model (POM) for API resources.
- Log API Requests and Responses: Enable logging to debug issues during test execution.
Example:
RestAssured.enableLoggingOfRequestAndResponseIfValidationFails();
Question: What are some examples of common API test cases?
Answer: Here are examples of API test cases for commonly encountered scenarios:
- Validation of Response Status Code: Test that the API returns the correct HTTP status code. Example: For a successful GET /user/123 request, the status code should be 200. Tip: Include negative test cases like checking for 404 for non-existent resources.
- Response Time Verification: Test that the API response time is within the acceptable limit. Example: For GET /products, the API should respond in less than 500ms. Tip: Automate response time checks for frequent monitoring.
- Header Validation: Test if required headers are present in the API response. Example: Verify the Content-Type header is application/json. Tip: Include test cases where headers like Authorization are mandatory.
- Pagination: Test that the API returns correct paginated results. Example: For GET /users?page=2&size=10, ensure the response contains exactly 10 users from page 2.
Tip: Validate totalPages or totalItems fields, if available.
- Error Messages and Codes: Test appropriate error codes and messages are returned for invalid inputs. Example: Sending an invalid userId should return 400 with the message, "Invalid user ID". Tip: Test for edge cases like sending null or special characters.
Question: Can you provide sample test cases for authentication and authorization APIs?
Answer: Authentication and authorization are important components of secure APIs. Below are a few test cases:
-
Positive Case: Valid Login Credentials: Test that a valid username and password returns a 200 status with a token in the response.
Example: Request: POST /login
{ "username": "testuser", "password": "password123" } Response:
{ "token": "abc123xyz" } Validate token structure (e.g., length, format, expiration).
-
Negative Case: Invalid Credentials: Test that the invalid credentials return 401 Unauthorized. 401 means the request lacked valid authentication, while 403 means the user is authenticated but lacks permission.
Example: Request:
{ "username": "testuser", "password": "wrongpass" } Response:
{ "error": "Invalid credentials" }
-
Token Expiry Validation: Test that expired tokens return 401 Unauthorized or a similar error. Tip: Check token expiration logic by simulating delayed requests.
-
Role-Based Authorization: Test that users with insufficient permissions are denied access.
Example: Admin user can POST /createUser. Guest user attempting the same returns 403 Forbidden.
-
Logout Validation: Test that the POST /logout endpoint invalidates tokens, preventing further use.
Example: After logout, GET /user should return 401 Unauthorized.
Question: What are example test cases for CRUD operations?
Answer: CRUD operations (Create, Read, Update, Delete) are basic in API testing. Below are the examples:
- Create (POST): Test Case: Validate successful creation of a resource.
- Read (GET): Test Case: Verify fetching an existing resource returns correct details.
- Update (PUT): Test Case: Validate updating an existing resource works as expected.
- Partial Update (PATCH): Test Case: Confirm PATCH allows partial updates.
- Delete (DELETE): Test Case: Validate successful deletion of a resource.
Tips for CRUD Testing:
o Use mock data for test environments to avoid corrupting production systems.
o Check database states post-operations for consistency.
o Validate cascading deletes for related entities.
