API TESTING CHEAT SHEET | QA SDET
API Rqsts
Use consistent and simple URIs.
Use plural for resources and noun-based naming.
Get all books: GET: /v1/books/
Get specific book: GET: /v1/books/1
Status Codes
1xx: Informational
2xx: Successful
200 OK
201 Created
202 Accepted
203 Non-authoritative
3xx: Redirected
4xx: Client errors
400 Bad Request
401 Unauthorized
402 Payment Required
403 Forbidden
404 Not Found
405 Method Not Allowed
429 Too Many Requests
5xx: Server errors
500 Internal Server Error
502 Bad Gateway
503 Service Unavailable
504 Gateway Timeout
Authentication/Authorization
Basic Auth: base64 encoded username:password
Bearer Token: e.g., Bearer someCrypticString
API Keys: Often passed as query strings (not secure)
Methods
GET – Retrieve a resource
PUT – Update an object/file/block
POST – Create a resource
PATCH – Update/modify
DELETE – Remove it
API Test Actions
Verify status codes
Verify payloads
Validate response schema
Validate application state
Validate required fields
Check for duplicates
Test with valid/invalid tokens
Test with timeouts
Test network interruptions
API Testing Tools
Postman
Swagger
API Dog
Bruno
RestAssured
Requests