<html><body><h2>1. What is API Testing?</h2><p style="text-align:justify;">First, we need to know about API. API stands for Application Programming Interface. That’s all. Then, you may ask: what is its real meaning? So, let's go with Application Programming first. Application Programming usually has 3 layers: User Interface, Business Logic, and Data Storage. Did you notice it, the “interface” word? “Interface” here means something simple like “A way that can be used to interact with something”. User Interface means “A way that User can use to interact with the Application”.</p><p style="text-align:justify;">And the “Application Programming Interface” means: “A way that Application Programming can use to interact with the Application/System ”. It is not for a specific User to use, just for the interaction between Machine to Machine, Service to Service or System to System, so we can call API is the middleware for the communication.</p><p style="text-align:justify;">With this information, let's go to “<strong>What is API Testing?</strong>”</p><p style="text-align:justify;">API Testing is not only similar to other kinds of Software testing: to ensure that the API is matched with the expected behavior (functionality), but also to test the non-functional aspect of the API which can affect the entire system (performance, reliability, security). API Testing is the most crucial part of the software development life cycle, so no doubt that this is the most challenging part. But, it is just a piece of cake if you understand it clearly and have a good plan to do it. Let’s see.</p><h2>2. Definition of Done for API Testing</h2><p style="text-align:justify;">Most of the time, testing a single API can be done with 3 simple steps: </p><ul><li style="text-align:justify;">Step 1: Send the request: to the targeted server URL with the desired parameter</li><li style="text-align:justify;">Step 2: Get the Response from the targeted server</li><li style="text-align:justify;">Step 3: Validate the Response: as expected from the test case</li></ul><p style="text-align:justify;">But as usual, we need to define the scope and the test case for API Testing first. So, to make sure that an API is tested thoroughly, we need to focus on the test case and the steps above, especially for step 3: Validate the Response.</p><p style="text-align:justify;">DoD for API Testing can be split into 2 parts:</p><h3>Functional Testing:</h3><p style="text-align:justify;">First of all, we need to make sure the API works correctly and matches all the requirements. Things that can be listed are:</p><ul><li style="text-align:justify;">API is available to use</li><li style="text-align:justify;">Response codes are correct: for Failed or for Success case</li><li style="text-align:justify;">Response body output is correct: for the Success case</li><li style="text-align:justify;">The error message is correct: for the Failed case</li><li style="text-align:justify;">Make sure that only the right person with the correct permission can use the API.</li></ul><p style="text-align:justify;">If the API passed these tests, we can say that the feature related to this issue will work correctly without any mismatch in the behavior.</p><h3>Non-functional Testing:</h3><p style="text-align:justify;">If the API had already passed the functional testing, why do we need this kind of test?</p><p style="text-align:justify;">“A feature works correctly doesn’t mean that it is a correct feature”. With this thinking, we found out that there are a lot more aspects that we need to cover before marking an API is Done:</p><ul><li style="text-align:justify;">Response time: some systems require correctness and can be slow, but some require fast response instead.</li><li style="text-align:justify;">Security: the API needs to match with security rules in the system, without exposing new security issues</li><li style="text-align:justify;">Reliable: for the high load of usage, if needed.</li><li style="text-align:justify;">And more.</li></ul><p style="text-align:justify;">Each System will have its own DoD, but above are the core general items for API Testing. </p><h2 style="text-align:justify;">3. Benefits of good API Testing Plan/Strategy</h2><p style="text-align:justify;">Everything will work, at least, when you have a good plan. But, having a good plan for API testing requires you to have enough knowledge of your system and a good mindset.</p><p style="text-align:justify;">The result of a good API testing plan are:</p><ul><li style="text-align:justify;">Increase the speed of validating the API.</li><li style="text-align:justify;">Collaboration between teams better (Team works on API and Team consumes API), without waiting for a long time to test.</li><li style="text-align:justify;">Increase productivity of the whole team.</li><li style="text-align:justify;">Easier to create the smoke test for the system, with the correct test case.</li><li style="text-align:justify;">Easier to convert to an Automation test case without spending more effort on re-writing the test case</li><li style="text-align:justify;">With good test case collections, changing the requirements is not a big deal because we always know where we need to change on our API test case.</li><li style="text-align:justify;">Unleash the true power of the QA/QC team to try more on “how to make it better/quicker” instead of doing the same testing thing over and over again.</li></ul><h2>4. Best Practices</h2><p>To ensure that you are doing API Testing in the right way, here are some best practices that you can apply:</p><ol><li>Design the test case correctly to ensure coverage, by using all possible API input combinations.</li><li>Organize test cases by category.</li><li>Test the happy case with the expected result first. After that, test for the failure case.</li><li>For the Failure case, make sure the API and system fail gracefully.</li><li>Keep the test case as isolated as possible, by reducing the dynamic variables in the test case.</li><li>Prioritize the API call to test the API quickly, and for easier to do the smoke test on it.</li><li>To make the testing run smoothly, create a plan for the API/Testcase call sequence.</li><li>Do the Load Test on this API and on other APIs to see how well the system handles stressful situations.</li><li>Apply the Automation if possible, besides the Manual test.</li></ol><h2>5. Tools for API Testing</h2><p>Calling API is easier said than done. It requires a lot of skill to manually call the API directly. Fortunately, we have a lot of tools that help us to call and test the API with familiar user interfaces, like:</p><ul><li><a href="https://www.postman.com"><u>Postman</u></a>: a tool for manual and automation API testing with an easy-to-use UI.</li><li><a href="https://www.soapui.org"><u>SoapUI</u></a>: the ultimate tool for testing SOAP, REST API. Supported Web Service testing.</li><li><a href="https://jmeter.apache.org"><u>JMeter</u></a>: a tool for load test API, that also supports functional tests.</li><li><a href="https://katalon.com"><u>Katalon</u></a>: a tool for automation test the UI (E2E test), but still can be used to do the API test.</li></ul><h2>6. Conclusion</h2><p style="text-align:justify;">API Testing allows developers to start testing early in the development cycle before the UI is ready. It helps to eliminate a lot of issues before the integration step happens and helps QA/QC access the thing that they can not explicitly access through the UI or through other services. Understanding API Testing is the crucial step in keeping your system more reliable and more stable, ensuring the success of our system in the future.</p><p> </p></body></html>

Nowadays, API is not a new thing in software development, and in the software testing area, we called the process of testing API is “API Testing”. But do you want to go deep dive into what, why, and how API testing should work? If YES is the answer, go right into the post

&lt;html&gt;&lt;body&gt;&lt;h2&gt;1. What is API Testing?&lt;/h2&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;First, we need to know about API. API stands for Application Programming Interface. That&rsquo;s all.&nbsp;Then, you may ask: what is its real meaning? So, let's go with Application Programming first.&nbsp;Application Programming usually has 3 layers: User Interface, Business Logic, and Data Storage.&nbsp;Did you notice it, the &ldquo;interface&rdquo; word? &ldquo;Interface&rdquo; here means something simple like &ldquo;A way that can be used to interact with something&rdquo;. User Interface means &ldquo;A way that User can use to interact with the Application&rdquo;.&lt;/p&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;And the &ldquo;Application Programming Interface&rdquo; means: &ldquo;A way that Application Programming can use to interact with the Application/System &rdquo;. It is not for a specific User to use, just for the interaction between Machine to Machine, Service to Service or System to System, so we can call API is the middleware for the communication.&lt;/p&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;With this information, let's go to &ldquo;&lt;strong&gt;What is API Testing?&lt;/strong&gt;&rdquo;&lt;/p&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;API Testing is not only similar to other kinds of Software testing: to ensure that the API is matched with the expected behavior (functionality), but also to test the non-functional aspect of the API which can affect the entire system (performance, reliability, security).&nbsp;API Testing is the most crucial part of the software development life cycle, so no doubt that this is the most challenging part. But, it is just a piece of cake if you understand it clearly and have a good plan to do it. Let&rsquo;s see.&lt;/p&gt;&lt;h2&gt;2. Definition of Done for API Testing&lt;/h2&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;Most of the time, testing a single API can be done with 3 simple steps:&nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Step 1: Send the request: to the targeted server URL with the desired parameter&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Step 2: Get the Response from the targeted server&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Step 3: Validate the Response: as expected from the test case&lt;/li&gt;&lt;/ul&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;But as usual, we need to define the scope and the test case for API Testing first. So, to make sure that an API is tested thoroughly, we need to focus on the test case and the steps above, especially for step 3: Validate the Response.&lt;/p&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;DoD for API Testing can be split into 2 parts:&lt;/p&gt;&lt;h3&gt;Functional Testing:&lt;/h3&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;First of all, we need to make sure the API works correctly and matches all the requirements. Things that can be listed are:&lt;/p&gt;&lt;ul&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;API is available to use&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Response codes are correct: for Failed or for Success case&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Response body output is correct: for the Success case&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;The error message is correct: for the Failed case&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Make sure that only the right person with the correct permission can use the API.&lt;/li&gt;&lt;/ul&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;If the API passed these tests, we can say that the feature related to this issue will work correctly without any mismatch in the behavior.&lt;/p&gt;&lt;h3&gt;Non-functional Testing:&lt;/h3&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;If the API had already passed the functional testing, why do we need this kind of test?&lt;/p&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;&ldquo;A feature works correctly doesn&rsquo;t mean that it is a correct feature&rdquo;. With this thinking, we found out that there are a lot more aspects that we need to cover before marking an API is Done:&lt;/p&gt;&lt;ul&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Response time: some systems require correctness and can be slow, but some require fast response instead.&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Security: the API needs to match with security rules in the system, without exposing new security issues&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Reliable: for the high load of usage, if needed.&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;And more.&lt;/li&gt;&lt;/ul&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;Each System will have its own DoD, but above are the core general items for API Testing.&nbsp;&lt;/p&gt;&lt;h2 style=&quot;text-align:justify;&quot;&gt;3. Benefits of good API Testing Plan/Strategy&lt;/h2&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;Everything will work, at least, when you have a good plan. But, having a good plan for API testing requires you to have enough knowledge of your system and a good mindset.&lt;/p&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;The result of a good API testing plan are:&lt;/p&gt;&lt;ul&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Increase the speed of validating the API.&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Collaboration between teams better (Team works on API and Team consumes API), without waiting for a long time to test.&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Increase productivity of the whole team.&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Easier to create the smoke test for the system, with the correct test case.&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Easier to convert to an Automation test case without spending more effort on re-writing the test case&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;With good test case collections, changing the requirements is not a big deal because we always know where we need to change on our API test case.&lt;/li&gt;&lt;li style=&quot;text-align:justify;&quot;&gt;Unleash the true power of the QA/QC team to try more on &ldquo;how to make it better/quicker&rdquo; instead of doing the same testing thing over and over again.&lt;/li&gt;&lt;/ul&gt;&lt;h2&gt;4. Best Practices&lt;/h2&gt;&lt;p&gt;To ensure that you are doing API Testing in the right way, here are some best practices that you can apply:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Design the test case correctly to ensure coverage, by using all possible API input combinations.&lt;/li&gt;&lt;li&gt;Organize test cases by category.&lt;/li&gt;&lt;li&gt;Test the happy case with the expected result first. After that, test for the failure case.&lt;/li&gt;&lt;li&gt;For the Failure case, make sure the API and system fail gracefully.&lt;/li&gt;&lt;li&gt;Keep the test case as isolated as possible, by reducing the dynamic variables in the test case.&lt;/li&gt;&lt;li&gt;Prioritize the API call to test the API quickly, and for easier to do the smoke test on it.&lt;/li&gt;&lt;li&gt;To make the testing run smoothly, create a plan for the API/Testcase call sequence.&lt;/li&gt;&lt;li&gt;Do the Load Test on this API and on other APIs to see how well the system handles stressful situations.&lt;/li&gt;&lt;li&gt;Apply the Automation if possible, besides the Manual test.&lt;/li&gt;&lt;/ol&gt;&lt;h2&gt;5. Tools for API Testing&lt;/h2&gt;&lt;p&gt;Calling API is easier said than done. It requires a lot of skill to manually call the API directly. Fortunately, we have a lot of tools that help us to call and test the API with familiar user interfaces, like:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;a href=&quot;https://www.postman.com&quot;&gt;&lt;u&gt;Postman&lt;/u&gt;&lt;/a&gt;: a tool for manual and automation API testing with an easy-to-use UI.&lt;/li&gt;&lt;li&gt;&lt;a href=&quot;https://www.soapui.org&quot;&gt;&lt;u&gt;SoapUI&lt;/u&gt;&lt;/a&gt;: the ultimate tool for testing SOAP, REST API. Supported Web Service testing.&lt;/li&gt;&lt;li&gt;&lt;a href=&quot;https://jmeter.apache.org&quot;&gt;&lt;u&gt;JMeter&lt;/u&gt;&lt;/a&gt;: a tool for load test API, that also supports functional tests.&lt;/li&gt;&lt;li&gt;&lt;a href=&quot;https://katalon.com&quot;&gt;&lt;u&gt;Katalon&lt;/u&gt;&lt;/a&gt;: a tool for automation test the UI (E2E test), but still can be used to do the API test.&lt;/li&gt;&lt;/ul&gt;&lt;h2&gt;6. Conclusion&lt;/h2&gt;&lt;p style=&quot;text-align:justify;&quot;&gt;API Testing allows developers to start testing early in the development cycle before the UI is ready. It helps to eliminate a lot of issues before the integration step happens and helps QA/QC access the thing that they can not explicitly access through the UI or through other services. Understanding API Testing is the crucial step in keeping your system more reliable and more stable, ensuring the success of our system in the future.&lt;/p&gt;&lt;p&gt;&nbsp;&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;

API Testing in Software Development

Related articles