API testing means sending requests directly to an application's HTTP endpoints, without going through its user interface, to verify that it returns the right data, the right status code and the right error behavior. The most common tools are Postman for manual testing, REST Assured for Java-based automation, and Playwright's API module. Its key advantage over UI testing is speed and stability — it reaches the database and business logic without passing through the interface, which is why a large share of regression tests are written at the API level.
Learn API testing by first building the API in Java, Express and NestJS, then testing it with DevTools, Swagger, Postman, REST Assured and Playwright.
For a tester who has never seen an API: first write the API yourself in Java/Spring, Express and NestJS, then test it with DevTools Network, Swagger, Postman, REST Assured and Playwright. With "Defect Birth" boxes answering "what bug would appear if the developer forgot this line?" at every step — all through a single example API (/api/v1/bugs).
What you can learn on this page
🌐 A1 · What Is an API? — Client, Server, Contract — An API is like a restaurant's **kitchen window**: you (the client) sit in the dining room and cannot walk into the kitchen (the server) directly — between them sits a window (the API) and a **menu** (the contract). The menu states what you can order (`GET /bug
📤 A2 · HTTP Request Anatomy — An HTTP request is like a **shipping parcel**: an **action label** (method — fetch/send/delete), an **address** (URL — to whom), **shipping notes** (headers — how to pack it, who is sending), and, when present, the **package inside the box** (body — the data b
📥 A3 · HTTP Response Anatomy — An HTTP response is like a **delivery receipt + package**: at the top a big **stamp** (status code — did it succeed, 200/201/404/500), below it **delivery notes** (headers — content type, cache, size), and at the very end **the package itself** (body — the act
🔧 A4 · HTTP Methods: GET / POST / PUT / PATCH / DELETE — HTTP methods are the **action verbs** on a bug record; like moves on a filing cabinet: **GET** = open the folder and READ (changing nothing), **POST** = ADD a new sheet, **PUT** = REPLACE the sheet entirely with a new one, **PATCH** = FIX a single line of the
🚦 A5 · Status Codes: 2xx / 3xx / 4xx / 5xx — Status codes are the server's **traffic light**, but not three colors — four districts: **2xx** = green (I did it), **3xx** = a sign (go another way — redirect), **4xx** = "your fault" (bad request: missing field, wrong path, unauthorized), **5xx** =
📋 A6 · Headers: Content-Type, Accept, Authorization — Headers are the **labels and customs paperwork** on a parcel: without touching the contents (body), they answer "what is this, how should it be opened, who sends it, can it be cached". **Content-Type** = "the package inside is JSON" (so the
🧩 A7 · JSON Structure: object, array, nested, null — JSON is data as a **system of nested boxes**: an **object** `{}` is a labeled box (key→value), an **array** `[]` is an ordered shelf (same-type boxes side by side), a **nested** structure is a box inside a box, and there are two sneaky states — `null` (the box
☕ B1 · Project Skeleton: Maven, spring-boot-starter-web — Setting up a Spring Boot project is like **fitting out a kitchen before opening a restaurant**: before cooking a single dish (endpoint) you prepare the stove, counter, and electricity (web server, dependencies, run mechanism). `spring-boot-starter-web` is a &q
Frequently Asked Questions
How do you do API testing?
API testing means sending requests directly to an application's HTTP endpoints, without the UI, to verify it returns the right data, status code and error behavior. The most common tools are Postman for manual testing and REST Assured for Java-based automation.
What is the difference between API testing and UI testing?
API testing reaches the database and business logic without going through the interface, making it much faster and more stable; UI testing verifies what the user actually sees on screen but is slower and more fragile because it depends on browser rendering.
How long does it take to learn API testing?
You can learn basic GET/POST requests with Postman in a day. Reaching interview-ready level — including Java-based automation with REST Assured, schema validation and authentication — usually takes 3-4 weeks of regular practice.
Which API testing tools are free?
Postman's core features, REST Assured (an open-source Java library) and the browser's own DevTools Network panel are all completely free. Some of Postman's team/collaboration features move to a paid plan.
What is the most common mistake in API testing?
Checking only the status code (`200 OK`) without verifying the actual content of the response body. The server can return 200 while sending the wrong data or a missing field — which is why schema and field-level assertions are essential.