API testing

API testing checks that application programming interfaces return the right data, status codes and error messages, and meet performance and security expectations, without going through the user interface. Because it skips the browser, it runs faster and is more stable than UI testing, so it usually covers most business logic in the test pyramid.

What an API test checks

• Status code: for example 200 for success, 201 for created, 400 for bad input, 401 or 403 for auth problems, 404 for missing resources.
• Response body: correct fields, types and values (schema validation).
• Error handling: clear messages for invalid or missing input.
• Auth and security: users cannot read or change data that is not theirs.
• Performance: response time stays within the agreed limit.

Example

A test sends POST /orders with a valid basket and expects 201 plus an order ID. A second test sends the same request without a token and expects 401. A third sends a negative quantity and expects 400 with a useful error.

Common mistakes

• Checking only the status code and ignoring the response body.
• Testing only the happy path and never invalid input or missing permissions.
• Sharing test data between tests, which makes them order-dependent and flaky.

Popular tools include Postman, Bruno, REST Assured and Playwright’s request API. API tests are a form of integration testing.

Read the full guides: Best API Testing Tools and Postman vs Bruno.

Sources: MDN: HTTP response status codes; OWASP API Security Project.