Why API testing validates backend logic in Testing Fundamentals - Automation Benefits in Action

Verify backend logic through API testing for user login

Preconditions (2)

Step 1: Send a POST request to https://api.example.com/login with JSON body {"username": "testuser", "password": "Test@1234"}

Step 2: Check the HTTP response status code

Step 3: Check the response body for a success message and a valid authentication token

✅ Expected Result: Response status code is 200, response body contains 'success': true and a non-empty 'token' string

Automation Requirements - pytest with requests library

Assertions Needed:

Assert response status code equals 200

Assert response JSON contains 'success' key with value true

Assert response JSON contains 'token' key with a non-empty string

Best Practices:

Use setup and teardown methods if needed

Use clear and descriptive assertion messages

Handle exceptions for request failures

Keep test data separate from test logic

Automated Solution

Testing Fundamentals

import requests
import pytest

class TestUserLoginAPI:
    base_url = "https://api.example.com"

    def test_user_login_success(self):
        url = f"{self.base_url}/login"
        payload = {"username": "testuser", "password": "Test@1234"}
        response = requests.post(url, json=payload)

        # Assert status code is 200
        assert response.status_code == 200, f"Expected status code 200 but got {response.status_code}"

        json_data = response.json()

        # Assert 'success' key is True
        assert json_data.get('success') is True, "Expected 'success' to be True in response"

        # Assert 'token' key exists and is a non-empty string
        token = json_data.get('token')
        assert isinstance(token, str) and token.strip() != "", "Expected a non-empty 'token' string in response"

This test script uses the requests library to send a POST request to the login API endpoint.

We check the HTTP status code to confirm the request succeeded (200 means OK).

Then we parse the JSON response and verify the backend logic by asserting the 'success' flag is true and a valid token is returned.

Assertions have clear messages to help understand failures.

This test directly validates backend logic by checking the API response without UI involvement.

Common Mistakes - 3 Pitfalls

Not checking the HTTP status code before parsing JSON

Hardcoding test data inside the test method

Not handling request exceptions

Bonus Challenge

Now add data-driven testing with 3 different sets of user credentials: one valid, one invalid password, one non-existent user

Show Hint

Practice

1. Why is API testing important for validating backend logic?

easy

A. Because it checks the server's response and business rules directly

B. Because it tests the colors and layout of the user interface

C. Because it only tests the database without any requests

D. Because it focuses on hardware performance

Solution

1. Step 1: Understand what API testing does and compare options

   API testing sends requests to the backend and checks the responses to verify logic and data handling. Only "Because it checks the server's response and business rules directly" correctly states that API testing checks server responses and business rules directly.

2. Final Answer:

   Because it checks the server's response and business rules directly -> Option A

3. Quick Check:

   API testing validates backend logic = Because it checks server response [OK]

Hint: API testing checks backend responses, not UI or hardware [OK]

Common Mistakes:

• Confusing API testing with UI testing
• Thinking API tests hardware or database only
• Assuming API testing is only about data storage

2. Which of the following is the correct way to send a GET request in an API test using JavaScript fetch?

easy

A. fetch('https://api.example.com/data', { method: 'DELETE' })

B. fetch('https://api.example.com/data', { method: 'POST' })

C. fetch('https://api.example.com/data', { method: 'GET' })

D. fetch('https://api.example.com/data', { method: 'PUT' })

Solution

1. Step 1: Identify the HTTP method for GET request and match in fetch options

   The GET method is used to retrieve data from the server. fetch('https://api.example.com/data', { method: 'GET' }) uses method: 'GET', which is correct for fetching data.

2. Final Answer:

   fetch('https://api.example.com/data', { method: 'GET' }) -> Option C

3. Quick Check:

   GET request uses method 'GET' in fetch [OK]

Hint: GET requests use method 'GET' in fetch options [OK]

Common Mistakes:

• Using POST or other methods instead of GET for data retrieval
• Omitting the method option (defaults to GET but unclear)
• Confusing HTTP methods in fetch

3. Consider this Python code snippet for API testing using requests library:

response = requests.post('https://api.example.com/login', json={'user':'test', 'pass':'1234'})
print(response.status_code)

What will be the output if the login is successful?

medium

A. 200

B. 404

C. 500

D. 401

Solution

1. Step 1: Understand HTTP status codes for API responses and match with success

   A successful POST request usually returns status code 200 (OK) or 201 (Created). Here, 200 is expected for successful login. Options 404 (Not Found), 500 (Server Error), and 401 (Unauthorized) indicate failure or errors.

2. Final Answer:

   200 -> Option A

3. Quick Check:

   Successful API call returns 200 status code [OK]

Hint: Success status code is 200 in API responses [OK]

Common Mistakes:

• Confusing 401 Unauthorized with success
• Thinking 404 means success
• Assuming 500 means success

4. You wrote this API test code snippet in JavaScript:

const response = await fetch('https://api.example.com/items', { method: 'GET' });
const data = await response.json();
console.log(data.items.length);

But the test fails with error: TypeError: Cannot read property 'length' of undefined. What is the likely cause?

medium

A. The URL is missing a trailing slash

B. The fetch method should be 'POST' instead of 'GET'

C. The await keyword is used incorrectly

D. The response JSON does not have an 'items' property

Solution

1. Step 1: Analyze the error message and check response structure

   The error says 'length' of undefined, meaning data.items is undefined. If the JSON response lacks 'items', accessing data.items.length causes this error.

2. Final Answer:

   The response JSON does not have an 'items' property -> Option D

3. Quick Check:

   Undefined property causes length error [OK]

Hint: Check if JSON property exists before accessing length [OK]

Common Mistakes:

• Changing HTTP method unnecessarily
• Misusing await keyword
• Assuming URL format causes this error

5. You want to test a backend API that calculates discounts based on user type and purchase amount. Which API testing approach best validates the backend logic?

hard

A. Test only the frontend UI to see if discount shows correctly

B. Send requests with different user types and amounts, then verify the discount in the response

C. Check the database directly without sending API requests

D. Run performance tests to measure response time only

Solution

1. Step 1: Identify what validates backend logic and compare options

   Sending requests with varied inputs and checking responses tests the business rules implemented in backend. "Send requests with different user types and amounts, then verify the discount in the response" sends inputs and verifies outputs, directly testing backend logic. Other options miss backend logic validation.

2. Final Answer:

   Send requests with different user types and amounts, then verify the discount in the response -> Option B

3. Quick Check:

   API tests validate logic by input-output checks [OK]

Hint: Test backend logic by varying inputs and checking outputs [OK]

Common Mistakes:

• Testing only UI without backend verification
• Skipping API requests and checking database only
• Focusing on performance instead of logic correctness