What Is an API?
An application programming interface (API) defines how software components interact. It describes the operations that can be called or requested, how to invoke them, the data formats they use, and the conventions they follow. APIs may also provide extension points so users can adapt existing capabilities. An API can be tailored to a specific component or follow an industry standard for interoperability. By hiding implementation details, an API supports modular software whose components can be used independently.
What Is API Testing?
API testing is a form of software testing. In a narrow sense, it checks the behavior of an application programming interface directly. More broadly, it can be part of integration testing: teams call APIs to verify system behavior, reliability, security, and performance.
API Testing Best Practices
- Follow a consistent API style, such as REST, use resource-oriented URIs, and return accurate HTTP status codes so clients can understand the resource model and request outcome.
- Provide detailed, accurate API documentation, such as a Swagger or OpenAPI specification.
- Consider versioning public APIs when it helps teams evolve them safely, for example
https://thoughtworks.com/v1/users/.
API Testing and the Testing Quadrants
Each testing quadrant has a different purpose and strategy. API tests commonly support the second and fourth quadrants, depending on what the tests are intended to learn or verify.
API Testing and the Test Pyramid
API tests occupy a relatively high layer in the test pyramid and exercise functionality and business rules at system and service boundaries. Teams run them after the service has been built and deployed to a test environment.
Types of API Testing
Functional testing can cover areas such as:
- Correctness
- Error handling
- Internal logic
- …
Non-functional testing can cover areas such as:
- Performance
- Security
- …
A Basic API Testing Workflow
- Send a request.
- Receive the response.
- Validate the response.
Designing Functional API Tests
Test design can consider scenarios such as:
- Positive behavior
- Negative behavior
- Error handling
- Internal logic
- …
Common techniques include:
- Equivalence partitioning
- Boundary value analysis
- Error guessing
- …
Designing Non-Functional API Tests
Security testing can include:
- Random testing
- SQL injection testing
- Cross-site scripting (XSS) testing
- …
Performance testing can include:
- Finding performance bottlenecks
- Stability testing
- …
API Testing Tools
Tools for sending API requests include:
- cURL
- SoapUI
- Postman
- Swagger UI
- …
HTTP proxy tools include:
- Fiddler
- Charles
- …
API performance testing tools include:
- ApacheBench (
ab) - JMeter
- …