Rest API Testing

What is API?

An Application Programming Interface (API) defines interaction between multiple softwares or mixed hardware-software. API is a set of programming code that enables data transmission between one software product and another.

API also provides extension mechanisms so that users can extend existing functionality in various. An API can be entirely custom, specific to a component, or designed based on an industry-standard.

API lets a developer make a specific “call” or “request” in order to send or receive information. JSON(JavaScript Object Notation) is used as an programming language to communicate. It can also be used to make a defined action such as updating or deleting data.

There are four basic request methods that can be made with API:

GET – Gathers the data
PUT – Updates the data
POST – Creates the data
DELETE – Deletes the data

Example: An API delivers a user response to a system and sends the system’s response back to a user. User clicks on “Add to Cart” button and API tells the website user added a product to a cart; the website puts the product in user cart, and user cart is updated.

Some of the API Testing Tools

Rapid API
Rest Assured
POSTMAN
SoapUI
JMeter

What is API testing?

API testing is a type of software testing, which make sure API is returning correct response as per the expected response. It performs verification directly at the API level.

It is a part of integration testing that determines whether the APIs meet the expectations of functionality, reliability, performance, and security.

Why API testing is needed?

Investigating an app at API level would be tough so it’s better to do it at first
Core functionalities of an API can be test
Consumes less time than GUI functional testing
Test data is mostly derived as JSON or XML format.
Language Independent
Easily integrated with GUI testing

Why a Checklist for API Testing is Important

An API checklist is important because:

It Improves Test Coverage – API specifications allows tester to detect errors at an early stage before getting into bigger problems.
It’s more Cost-Effective – API testing requires less coding, which becomes a faster and more affordable process.
It provides stronger security – APIs are designed to remove common vulnerabilities, so it provides more protection for your application if we follow an API security checklist.
It’s Language Independent – By exchanging data via JSON or XML, user can select any language for API testing.
It Integrates simply with GUI – An API is highly integral when performing functional GUI testing.

Types of Tests to Perform on Your APIs

Validation Testing – This testing process occurs at the end of the development cycle to validate whether the API’s basic parts and functions are correct or not.
UI Testing – UI API testing examines the user interface. UI testing focuses on the interface experience those ties into the API to verify the user experience is per the expected result.
Security Testing – Security tests main aim is to cover any vulnerability, threat or risk within the API so that malicious attacks can be prevented. Security testing can identify all possible loopholes and API weaknesses that can potentially result in a loss of information, revenue and reputation.
Load Testing – Load testing reviews the API performance for specific load, by adding number of user’s activity into the API. User can examine how well the API behaves with a spike of users accessing the API.

REST API

REST stands for REpresentational State Transfer. It is an architectural style that defines a set of rules in order to create Web Services. In a client-server communication, REST suggests to create an object of the data requested by the client and send values of that object in response to the user.

Just like any regular website, REST API’s use HTTP for communication. The data can be sent or received in the form of JSON or XML.

For example, if a user is requesting for a movie in Noida at a certain place and time, then you can create an object on the server-side.

Principles which REST API Follows

Client-Server: In client-server architecture the client and the server should be separate from each other and allowed to evolve individually. This enhances the portability across multiple platforms as well as the scalability of the server components.
Stateless: REST APIs are stateless, meaning history of any request or response or not saved. Once the request is sent it closes the connection and establishes the new connection to give the response.
Cache: For better performance, applications are often made cacheable which saves the processing time. This is done by labelling the response from the server as cacheable. If the response is defined as cacheable, then the client cache can reuse the response data for equivalent responses in the future.
Uniform Interface: To separate client from server is by having a uniform interface that allows independent changes into the application without having the application’s services, or models and actions, tightly coupled to the API layer itself.
Layered System: REST APIs have different layers of their architecture working together to build a hierarchy which helps to create a more scalable and modular application.
Code on Demand: This is an optional constraint and is used the least. Code on Demand allows code or applets to be transmitted via the API for use within the application.

Parts of REST API:

A REST request is made up of the following parts:

An HTTP verb that describes what action should be taken
A Uniform Resource Locator (URL) that defines the location of the request
HTTP headers that provide information to the server about the request
A request body that provides further details for the request (this can be sometimes empty)

Here are the most common HTTP verbs: