API Testing

Pragya Yadav

Simplified Beginner’s Guide for SOAP & REST (2024 Edition)

Here are a few API statistics to give you an idea about the popularity and usage of API today and in the coming years.

• Over 90% of developers use APIs and spend 30% of their time coding new APIs.
• The API management market is projected to grow at a CAGR of 32.9% to be worth $5.1 billion by 2023.
• There are over two million API repositories on GitHub.
• Cloud automation will become a $623.3 Billion industry by 2023
• Open banking to have 130 million users by 2024 powered by APIs.

So now you know the magnitude and impact APIs have in our daily lives as we interact with apps daily. As well as their contribution to the growth and development of the software industry.

This article provides a basic idea of APIs, focusing more on REST and SOAP. We will also see the steps for API testing, tips and tricks, tools, and advanced topics.

What is an Application Programming Interface (API)?

Application Programming Interface, or API, is a set of rules, protocols, and tools for building software and applications. It specifies how software components should interact with each other. Different systems and devices communicate with each other using APIs, as they act as a middle layer that allows the exchange of data between different systems/services.

API lets the application talk with the outside world and exchange information and services seamlessly.

Example: Flight Booking

Consider one example when booking a flight ticket for your upcoming vacation. You enter the travel departure city, destination, date, and other information in the app and click on Search. The app uses an API to query the databases of multiple airlines to provide you with the flights that match your search criteria.

Each airline service has its own API to interact with the travel services (app). These APIs specify the rules/protocols to retrieve the airlines’ flight data, such as schedules, availability, and pricing for your travel plan.

When the travel service app sends a request with input data to the flight service’s API, it provides the relevant output data to the travel service. This gathered data is then presented to you in a formatted form on the travel service app. This lets you compare multiple options and choose the best available flight for your vacation.

So, these APIs help communication in real-time between the travel service and various airline databases. And then provide you with the most current information in real-time. Do you find it fascinating?

What are REST and SOAP?

Here are broadly two types of approaches to creating and using web services for web API:

SOAP (Simple Object Access Protocol)

SOAP is a protocol to exchange structured information in web services. It relies on XML (Extensible Markup Language) for its message format. It is known for its high-security standardized protocol and is defined by W3C.

REST (REpresentational State Transfer)

REST is an architectural style rather than a protocol for distributed hypermedia systems. Unlike SOAP, it uses HTTP methods and is more flexible and faster. It is due to the lightweight JSON (JavaScript Object Notation) format.

Your choice between REST and SOAP often depends on the requirements of the service. If you are working with public APIs, use REST for web services due to its simplicity and performance. You can use SOAP for enterprise-level critical services requiring high security and reliability.

REST vs. SOAP

API Request Types

Below are the most common HTTP request types used primarily by REST APIs:

GET

This is one of the most commonly used HTTP methods. It is used to retrieve data from a server. When you visit a website or click on a link, you often make a GET request. It is read-only, meaning it doesn’t change any data on the server.

POST

This method sends data to a server to create a new resource. They are used when submitting form data or uploading a file. Unlike GET, POST requests can change the data on a server.

PUT

This is used to update an existing resource or create it if it doesn’t exist. The request includes the data or changes you want to apply to the resource.

DELETE

As the name suggests, this method deletes a specified resource. Once executed, the resource is removed.

PATCH

It is used for modifying an existing resource but differs from PUT because it is used for partial updates. For example, if you just want to update one user profile field (like changing the email address), you would use PATCH.

Note: Among these, GET and POST are used most frequently. GET is commonly utilized for fetching data, while POST is used for sending data. PUT and DELETE are essential for applications that need full CRUD (Create, Read, Update, Delete) capabilities.

How to Perform API Testing?

Before we look into the steps required for API testing, let us have a quick introduction to API status codes:

API Status Codes

1xx (Informational): Indicates that everything is okay so far and the client should continue with the request or ignore it if it’s already done.

2xx (Successful): The request was received, understood, and accepted.

• 200 OK: Standard response for successful requests.
• 201 Created: The request has been fulfilled, and a new resource has been created.

3xx (Redirection): The client must take additional action to complete the request.

• 301 Moved Permanently: The URL of the requested resource has been changed permanently.
• 302 Found: The resource has been moved temporarily to a different URL.

4xx (Client Errors): The request contains the wrong syntax or cannot be fulfilled by the server.

• 400 Bad Request: The server couldn’t understand the request due to invalid syntax.
• 401 Unauthorized: The request lacks proper authentication.
• 403 Forbidden: The server understands the request, but it refuses to fulfill it.
• 404 Not Found: The server can’t find the requested resource.

5xx (Server Errors): The server failed to fulfill a valid request.

• 500 Internal Server Error: A generic error message when an unknown error occurs on the server.
• 502 Bad Gateway: The server received an invalid response from an upstream server.
• 503 Service Unavailable: The server is not ready because it’s overloaded or under maintenance.

API Testing Steps

API testing is mainly done by creating and sending the request with the required input data. The next step is to receive the response with output data and verify that the response received is as per the expectation.

Below are the detailed steps for API testing:

• Understand the App and API Functionality: Clearly understand the API’s functionality. This includes understanding the data it will handle, inputs, expected response from API, etc.
• Select Correct Tools: Tools like Postman, SoapUI, testRigor, etc., are famous for API testing. They help create, manage, and execute tests based on the type of API, i.e., SOAP or REST. Read an informative blog about the best API testing tools.
• Set Up the Testing Environment and Data: This involves setting up the database and server for the conditions under which the API will run. It also includes setting up any required authentication tokens, test data, or API keys.
• Ready the Test Cases: All possible API request and response scenarios, including edge cases, should be covered. Include positive tests (where you test the API with valid input) and negative tests (where you try it with invalid input). Test cases should also cover HTTP methods (GET, POST, PUT, DELETE, etc.), error handling, etc.

Read here a good article about Negative and Positive Testing.

• Test Execution: Run the tests to validate the API’s functionality, reliability, performance, and security using appropriate testing types. You can use automation testing to speed up the testing process with the help of many good API testing tools available in the market.
• Check Results: Analyze the test results to identify any defects or areas for improvement. This validation includes verifying the data returned by the API, the status code, and the response time.
• Test for Security and Authorization: APIs are a middle layer between apps and services. This requires them to have proper security and authorization mechanisms in place. Also, they need to be tested for the same since they have an essential role in banking, e-commerce, and other crucial domains. This includes testing for authentication, authorization, data encryption, and access control.

Advanced Topics in API Testing

Mocking and Stubbing: These techniques are used to simulate API behavior without having an actual API. Create mock services and virtual APIs to simulate various components in a system. This allows testers to isolate and test specific parts of the system without requiring all components to be available or operational.

CI/CD Integration: You should integrate the app’s API testing into CI/CD pipelines to make sure continuous testing is happening seamlessly. Here are the top 7 CI/CD tools to help you set up your CI/CD pipeline.

API Contract Testing: It focuses on checking that API follows its specifications. This involves using contract testing tools such as Pact, Swagger, OpenAPI, etc., verifying that the API responses meet the agreed-upon contract between the client and the server.

IoT API Testing: To test Internet of Things (IoT) APIs, you should test hardware integration, real-time data processing, and scalability challenges.

Using testRigor for API Testing

Intelligent and generative AI-powered testing tools such as testRigor help you easily manage your API testing. The test cases are written in plain English, where there is no need to learn any separate tool for API testing specifically. testRigor is a single solution for all your testing needs as it handles web, mobile, desktop, and API testing singlehandedly and easily.

call api <TYPE> "<API_URL>" with headers "a:a" and "b:b" and body "body" and get "JsonPath" and save it as "variableName"

call api post "http://dummy.restapiexample.com/api/v1/create" with headers "Content-Type:application/json" and "Accept:application/json" and body "{\"name\":\"James\",\"salary\":\"123\",\"age\":\"32\"}" and get "$.data.name" and save it as "createdName" and then check that http code is 200

You can perceive how easily, in a single command, the whole request-response cycle is tested, and the response code is verified, too. Can it get simpler than this?

API Testing Tips for Beginners

• Focus on Business Logic: Understand the business logic behind the API to create more effective test cases.
• Test API Methods: If using REST, test thoroughly for GET, POST, PUT, DELETE, and PATCH methods.
• Check Response Codes: Check that your API returns the correct HTTP status codes.
• Test Under Different Conditions: Test the API under various conditions, including peak traffic and low resources.
• Automate More: Automate API tests to save time and effort, especially for regression testing.
• Control Attacks: APIs are a common target for security threats and attacks. Security testing includes testing for authentication, data encryption, and access control.
• Negative Testing is Important: Do not just test for expected outcomes. Test how the API handles incorrect or incomplete input data through negative testing.
• Monitor App’s Performance: Test how the API performs under load to check how your application can handle real-world usage gracefully.
• Maintain Scripts Regularly: Keep your tests updated with any changes in the API.

Conclusion

“Testing is not about finding bugs or proving they exist; it is about understanding the state of software” – James A. Whittaker.

This quote quickly shows us the essence of API testing. It is not just about finding errors. It is more about understanding the behavior of the software in different scenarios. API testing tools are your friends in these testing processes, and the correct choice may ease your testing efforts and reduce the costs considerably. Here are some helpful Tips to start API testing with testRigor.