Web API Testing: A Beginner's Guide to REST APIs

What is API Testing?

API testing verifies that your web APIs work correctly by sending requests and validating responses. It's essential for debugging, development, and quality assurance.

REST API Basics

REST (Representational State Transfer) APIs use standard HTTP methods:

| Method | Purpose | Example | |--------|---------|---------| | GET | Retrieve data | Get a user profile | | POST | Create data | Create a new user | | PUT | Replace data | Update entire user | | PATCH | Partial update | Change user's email | | DELETE | Remove data | Delete a user | | HEAD | Get headers only | Check if resource exists | | OPTIONS | Get allowed methods | Discover API capabilities |

HTTP Status Codes

Success (2xx)

• 200 OK: Request succeeded
• 201 Created: Resource created successfully
• 204 No Content: Success with no response body

Client Error (4xx)

• 400 Bad Request: Invalid request format
• 401 Unauthorized: Authentication required
• 403 Forbidden: Insufficient permissions
• 404 Not Found: Resource doesn't exist
• 409 Conflict: Resource state conflict
• 422 Unprocessable Entity: Validation failed

Server Error (5xx)

• 500 Internal Server Error: Unexpected server failure
• 502 Bad Gateway: Upstream server error
• 503 Service Unavailable: Server temporarily down
• 504 Gateway Timeout: Upstream server timeout

Try It: API Tester Tool

Use our API Tester to send HTTP requests and inspect responses directly in your browser.

Testing a REST API: Step by Step

1. Simple GET Request

GET https://jsonplaceholder.typicode.com/users/1

Response:

{
  "id": 1,
  "name": "Leanne Graham",
  "email": "[email protected]"
}

2. POST Request with JSON Body

POST https://jsonplaceholder.typicode.com/users
Content-Type: application/json

{
  "name": "New User",
  "email": "[email protected]"
}

3. Testing with Authentication

Common auth patterns:

Authorization: Bearer YOUR_TOKEN
Authorization: Basic base64(user:pass)
X-API-Key: your-api-key

Use our Base64 Encoder for Basic auth encoding and JWT Decoder to inspect tokens.

4. Query Parameters

GET https://api.example.com/users?page=2&limit=10&sort=name

Common API Testing Patterns

CRUD Testing

1. Create: POST /api/items → 201 Created, save returned ID
2. Read: GET /api/items/{id} → 200 OK, verify data
3. Update: PUT /api/items/{id} → 200 OK, verify changes
4. Delete: DELETE /api/items/{id} → 204 No Content

Error Testing

1. Send invalid JSON → expect 400
2. Access without auth → expect 401
3. Access other user's data → expect 403
4. Request non-existent ID → expect 404

Request Headers to Know

Content-Type: application/json    // JSON request body
Accept: application/json          // Expected response format
Authorization: Bearer token       // Authentication
Cache-Control: no-cache           // Prevent caching

Use our HTTP Headers Checker to inspect any URL's response headers.

API Testing Tools

• API Tester: Send HTTP requests and inspect responses
• HTTP Headers Checker: View response headers
• Header Analyzer: Analyze security headers
• HTTP Status Codes: Reference all status codes
• HTTP Methods: Reference HTTP methods
• MIME Types: Look up content types
• JSON Formatter: Format API response data
• JWT Decoder: Inspect authentication tokens
• URL Parser: Break down API URLs

API Testing Best Practices

1. Test happy paths first: Verify normal operations work
2. Test error paths: Verify proper error codes and messages
3. Test edge cases: Empty data, boundary values, special characters
4. Use environment variables: Don't hardcode URLs or tokens
5. Document your tests: Keep track of what you've tested
6. Automate repetitive tests: Use scripts for regression testing

Conclusion

API testing is a core developer skill. Start with our API Tester and reference the HTTP Status Codes when debugging responses.