🔌 API Testing

Learn API testing by first building the API in Java, Express and NestJS, then testing it with DevTools, Swagger, Postman, REST Assured and Playwright.

For a tester who has never seen an API: first write the API yourself in Java/Spring, Express and NestJS, then test it with DevTools Network, Swagger, Postman, REST Assured and Playwright. With "Defect Birth" boxes answering "what bug would appear if the developer forgot this line?" at every step — all through a single example API (/api/v1/bugs).

What you can learn on this page

  • 🌐 A1 · What Is an API? — Client, Server, Contract — An API is like a restaurant's **kitchen window**: you (the client) sit in the dining room and cannot walk into the kitchen (the server) directly — between them sits a window (the API) and a **menu** (the contract). The menu states what you can order (`GET /bug
  • 📤 A2 · HTTP Request Anatomy — An HTTP request is like a **shipping parcel**: an **action label** (method — fetch/send/delete), an **address** (URL — to whom), **shipping notes** (headers — how to pack it, who is sending), and, when present, the **package inside the box** (body — the data b
  • 📥 A3 · HTTP Response Anatomy — An HTTP response is like a **delivery receipt + package**: at the top a big **stamp** (status code — did it succeed, 200/201/404/500), below it **delivery notes** (headers — content type, cache, size), and at the very end **the package itself** (body — the act
  • 🔧 A4 · HTTP Methods: GET / POST / PUT / PATCH / DELETE — HTTP methods are the **action verbs** on a bug record; like moves on a filing cabinet: **GET** = open the folder and READ (changing nothing), **POST** = ADD a new sheet, **PUT** = REPLACE the sheet entirely with a new one, **PATCH** = FIX a single line of the
  • 🚦 A5 · Status Codes: 2xx / 3xx / 4xx / 5xx — Status codes are the server's **traffic light**, but not three colors — four districts: **2xx** = green (I did it), **3xx** = a sign (go another way — redirect), **4xx** = "your fault" (bad request: missing field, wrong path, unauthorized), **5xx** =
  • 📋 A6 · Headers: Content-Type, Accept, Authorization — Headers are the **labels and customs paperwork** on a parcel: without touching the contents (body), they answer "what is this, how should it be opened, who sends it, can it be cached". **Content-Type** = "the package inside is JSON" (so the
  • 🧩 A7 · JSON Structure: object, array, nested, null — JSON is data as a **system of nested boxes**: an **object** `{}` is a labeled box (key→value), an **array** `[]` is an ordered shelf (same-type boxes side by side), a **nested** structure is a box inside a box, and there are two sneaky states — `null` (the box
  • ☕ B1 · Project Skeleton: Maven, spring-boot-starter-web — Setting up a Spring Boot project is like **fitting out a kitchen before opening a restaurant**: before cooking a single dish (endpoint) you prepare the stove, counter, and electricity (web server, dependencies, run mechanism). `spring-boot-starter-web` is a &q