API testing checks that services accept the right input, enforce access rules and return correct, stable responses.
On this cheat sheet
Methods
| Method | Typical use | Key check |
|---|---|---|
GET | Read data | No state change. |
POST | Create or start action | Duplicates and retry safety. |
PUT | Replace resource | Repeated request has same effect. |
PATCH | Update selected fields | Untouched fields remain unchanged. |
DELETE | Remove resource | Later reads and repeated deletes. |
HEAD | Headers only | No response body. |
Headers
Content-Type: format of the request or response body.Accept: response format the client accepts.Authorization: credentials or access token.Cache-Control: caching rules.Idempotency-Key: prevents duplicate processing when supported.- Correlation or request ID: helps trace failures.
Authentication
| Basic | Authorization: Basic base64(user:password) |
| Bearer token | Authorization: Bearer <token> |
| API key | Header or query parameter defined by the API. |
| OAuth 2.0 | Test scopes, expiry, refresh and revocation. |
Never: commit real credentials or paste tokens into bug reports.
Bodies
POST /users
Content-Type: application/json
{
"name": "Ana",
"email": "ana@example.com",
"role": "viewer"
}
Test valid data, omitted optional fields, explicit null, empty values, boundary lengths, special characters, arrays and nested objects.
Validation
- Status code and response time meet the requirement.
- Response
Content-Typeand schema are correct. - Required fields, types, formats and values are correct.
- Sorting, filtering, pagination and totals agree.
- Headers such as caching and rate limits are correct.
- Database and downstream effects match the response.
- A repeated request behaves safely.
// Playwright API example
const response = await request.post('/users', { data: user });
expect(response.status()).toBe(201);
const body = await response.json();
expect(body).toMatchObject({ email: user.email });
Negative tests
Input
Missing, extra, wrong-type, too long, malformed or unsupported values.
Access
No token, expired token, wrong scope, wrong role and another user's resource ID.
Protocol
Wrong method, media type, encoding, headers or API version.
State
Duplicate create, stale version, deleted resource and invalid transition.
Limits
Rate limit, large payload, page boundaries and concurrent requests.
Failure
Timeout, unavailable dependency, retry and partial processing.