REST API testing basics in Testing Fundamentals - Framework Patterns

Framework Mode - REST API testing basics

Folder Structure

api-test-project/
├── tests/
│   ├── test_users.py
│   ├── test_orders.py
│   └── test_products.py
├── utils/
│   ├── api_client.py
│   └── helpers.py
├── config/
│   ├── config.yaml
│   └── credentials.yaml
├── reports/
│   └── latest_report.html
├── conftest.py
└── requirements.txt
  

Test Framework Layers

• API Client Layer: Handles sending HTTP requests (GET, POST, PUT, DELETE) and receiving responses. Encapsulates base URL, headers, and authentication.
• Test Layer: Contains test cases that call API client methods and assert expected results like status codes and response data.
• Utilities Layer: Helper functions for common tasks like data formatting, token generation, or response parsing.
• Configuration Layer: Stores environment settings, API endpoints, credentials, and other variables.

Configuration Patterns

Use separate YAML or JSON files to store environment-specific data:

• config.yaml holds base URLs for dev, staging, and production.
• credentials.yaml stores API keys or tokens securely (avoid hardcoding in code).

Load configuration at test start to switch environments easily.

Example snippet to load config in Python:

import yaml

with open('config/config.yaml') as f:
    config = yaml.safe_load(f)

base_url = config['environments']['staging']['base_url']

Test Reporting and CI/CD Integration

• Use test runners like pytest with plugins such as pytest-html to generate readable HTML reports.
• Reports show passed/failed tests, error messages, and response details for failures.
• Integrate tests into CI/CD pipelines (GitHub Actions, Jenkins) to run API tests automatically on code changes.
• Fail the build if critical API tests fail to prevent broken APIs from deploying.

Best Practices

1. Use clear and descriptive test names that explain what API behavior is tested.
2. Isolate tests so each test can run independently without relying on others.
3. Validate both status codes and response content to ensure API correctness.
4. Use data-driven testing to test multiple input scenarios efficiently.
5. Handle authentication securely and refresh tokens if needed during tests.

Self Check

Where would you add a new test file for testing the "payment" API endpoints in this framework structure?

Key Result

Organize REST API tests with clear layers: API client, tests, utilities, and config for maintainability and scalability.

Practice

1. What is the main purpose of REST API testing?

easy

A. To design the user interface of a web application

B. To write the backend code of the API

C. To check if the API correctly sends and receives data over the web

D. To create database tables for storing data

Solution

1. Step 1: Understand REST API testing goal

   REST API testing focuses on verifying communication between client and server using HTTP requests and responses.

2. Step 2: Identify the correct purpose

   Among the options, only checking data exchange over the web matches REST API testing.

3. Final Answer:

   To check if the API correctly sends and receives data over the web -> Option C

4. Quick Check:

   REST API testing = data exchange check [OK]

Hint: Remember: REST API testing checks data flow, not UI or code [OK]

Common Mistakes:

• Confusing API testing with UI design
• Thinking API testing means coding the API
• Mixing API testing with database design

2. Which HTTP method is commonly used to retrieve data from a REST API?

easy

A. POST

B. GET

C. DELETE

D. PUT

Solution

1. Step 1: Recall HTTP methods and their uses

   GET is used to request data, POST to send data, DELETE to remove data, and PUT to update data.

2. Step 2: Match method to retrieving data

   Retrieving data means reading it without changing, which is the GET method.

3. Final Answer:

   GET -> Option B

4. Quick Check:

   Retrieve data = GET method [OK]

Hint: GET means get data; POST means send data [OK]

Common Mistakes:

• Choosing POST instead of GET for data retrieval
• Confusing PUT with GET
• Using DELETE to get data

3. Given this response from a REST API test:
{"status":200, "body": {"name": "Alice", "age": 30}}
What does the status code 200 mean?

medium

A. The request was successful and data is returned

B. The requested resource was not found

C. There was a server error processing the request

D. The request was unauthorized

Solution

1. Step 1: Understand HTTP status codes

   Status code 200 means OK, indicating success. 404 means not found, 500 means server error, 401 means unauthorized.

2. Step 2: Match code 200 to meaning

   Since the response shows 200, it means the request succeeded and data is returned.

3. Final Answer:

   The request was successful and data is returned -> Option A

4. Quick Check:

   Status 200 = success [OK]

Hint: 200 means success; 404 means missing; 500 means error [OK]

Common Mistakes:

• Confusing 200 with error codes
• Thinking 200 means unauthorized
• Ignoring the status code meaning

4. You wrote this test code to check a REST API response status:

response = send_request('GET', '/users/1')
assert response.status_code = 200

What is the error in this code?

medium

A. Incorrect HTTP method used

B. Using single quotes instead of double quotes in the URL

C. Missing parentheses in the send_request function call

D. Using '=' instead of '==' in the assertion

Solution

1. Step 1: Check assertion syntax

   In Python, '=' is for assignment, '==' is for comparison. Assertions need '==' to compare values.

2. Step 2: Identify the error in the assertion line

   The code uses '=' which causes a syntax error. It should be '==' to check if status_code equals 200.

3. Final Answer:

   Using '=' instead of '==' in the assertion -> Option D

4. Quick Check:

   Assertion needs '==' not '=' [OK]

Hint: Use '==' to compare values in assertions, not '=' [OK]

Common Mistakes:

• Confusing assignment '=' with comparison '=='
• Ignoring syntax errors in assertions
• Assuming single quotes cause error here

5. You want to test a REST API endpoint that returns a list of users. Which test case best checks if the API handles an empty user list correctly?

hard

A. Send a GET request and verify the response body is an empty list and status code is 200

B. Send a POST request with user data and check for status code 201

C. Send a DELETE request to remove all users and expect status code 404

D. Send a GET request and expect status code 500 when no users exist

Solution

1. Step 1: Understand the test goal for empty user list

   The API should return an empty list with a success status (200) when no users exist.

2. Step 2: Evaluate each option for correctness

   Send a GET request and verify the response body is an empty list and status code is 200 correctly sends GET and expects empty list and 200. Send a POST request with user data and check for status code 201 is about creating users, not testing empty list. Send a DELETE request to remove all users and expect status code 404 expects 404 after deletion, which is incorrect for empty list response. Send a GET request and expect status code 500 when no users exist expects 500 error, which is wrong for empty data.

3. Final Answer:

   Send a GET request and verify the response body is an empty list and status code is 200 -> Option A

4. Quick Check:

   Empty list test = GET + empty list + 200 [OK]

Hint: Empty data should return 200 with empty list, not error [OK]

Common Mistakes:

• Expecting error codes for empty data
• Using wrong HTTP methods for retrieval
• Confusing creation or deletion tests with retrieval