Why auth testing secures APIs in Postman - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to add an Authorization header in Postman.

Postman

pm.request.headers.add({key: 'Authorization', value: '[1]'});

Drag options to blanks, or click blank then click option'

AUser-Agent: PostmanRuntime

BBearer {{token}}

CAccept: */*

DContent-Type: application/json

Attempts:

3 left

💡 Hint

Common Mistakes

Using headers unrelated to authentication like Content-Type or User-Agent.

The Authorization header with a Bearer token is required to authenticate API requests securely.

2fill in blank

medium

Complete the test script to check if the response status code is 401 for unauthorized access.

Postman

pm.test('Unauthorized status code', function () { pm.response.to.have.status([1]); });

Drag options to blanks, or click blank then click option'

A500

B404

C200

D401

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing 401 with 404 (not found) or 200 (success).

Status code 401 means unauthorized access, which is expected when auth fails.

3fill in blank

hard

Fix the error in the test script to verify the presence of a token in the response JSON.

Postman

pm.test('Token is present', function () { pm.expect(pm.response.json().[1]).to.exist; });

Drag options to blanks, or click blank then click option'

Aaccess_token

Bstatus

Cerror

Dmessage

Attempts:

3 left

💡 Hint

Common Mistakes

Checking for unrelated keys like 'status' or 'error'.

The 'access_token' field holds the token needed for authenticated API calls.

4fill in blank

hard

Fill both blanks to create a test that checks if the response JSON has a user ID and the status is 'success'.

Postman

pm.test('Response has user ID and success status', function () { pm.expect(pm.response.json().[1]).to.be.a('string'); pm.expect(pm.response.json().status).to.eql('[2]'); });

Drag options to blanks, or click blank then click option'

Auser_id

Bsuccess

Cerror

Did

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'error' as status or wrong key names for user ID.

The user ID is usually under 'user_id' and the status should be 'success' for a valid response.

5fill in blank

hard

Fill all three blanks to write a test that verifies the token type, token expiration, and that the token is a non-empty string.

Postman

pm.test('Token details are valid', function () { const jsonData = pm.response.json(); pm.expect(jsonData.token_type).to.eql('[1]'); pm.expect(jsonData.expires_in).to.be.above([2]); pm.expect(jsonData.access_token).to.be.a('[3]').and.not.empty; });

Drag options to blanks, or click blank then click option'

ABearer

B0

Cstring

DToken

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong token type, zero or negative expiration, or wrong data types.

The token type should be 'Bearer', expiration time should be greater than 0, and the access token must be a non-empty string.