What is REST, and what are REST APIs?

REST stands for Representational State Transfer and API stands for Application Program Interface. It is a type of architectural design pattern for APIs. It is a predominant development style for web applications and services. APIs that are designed using REST are called REST APIs, and they allow web applications and services to interact with resources stored in a web server. These interactions typically take place over HTTP and usually consist of the following:

GET (retrieval of the resource)
POST (creation of the resource)
PUT (updating the resource)
DELETE (deletion of the resource)

1. Make an API testing strategy checklist

The test strategy is the high-level description of the test requirements from which a detailed test plan can later be derived, specifying individual test scenarios and test cases. An API test strategy lays out your goals and the steps to get there. This can be a detailed formal document or a checklist such as below.

• Define the testing process, level of testing, roles, and responsibilities of every team member.
• Discuss with the Product owner and development team about the list of API’s the organization is going to use and prioritize them in order of their importance to applications and customers.
• Determine how often the tests should be run, and how are they deployed with a commercial testing tool or an internally developed tool.
• Define the types of tests to run. For example access security, endpoint security, data security, data validation and file validation.
• Develop a plan that ensures test data won't harm production data that's required for business analytics and reporting.
• Evaluate and select an API testing tool.
• Schedule and regularly conduct functional and security tests.
• Plan for resources to maintain and update API tests.

2. Pick the right API tool

API testing isn’t very different from any other testing. But, it requires specific tools to test it. All API testing tools let testers submit requests manually — in other words, you write out the request, send it, and see how the API reacts. However, it would take a while to test any API this way, which is why many testing tools also support automated tests. Automated testing systems run many scenarios quickly with minimal human input. A good API testing tool, especially one with automated testing, saves time and helps testers shift left to catch bugs earlier. Many of these tools are available for download completely free of charge, while others require a purchase.

3. Perform API smoke testing.

When a new API is ready for testing, the very first test that needs to be performed is smoke testing. Smoke test is a mini and rapid regression test to ensure that the basic and critical functionality is working. This helps determine if the API code is flawed and avoids any further testing which will be a waste of time and resources. As such, a typical API smoke test could be the following:

• Ensure API responds to correct authorization via all agreed auth methods – Bearer token, cookies, OAuth, etc. – as defined in the spec
• Test the basic API’s to check if it responds
• Test the API’s with only positive test data to see if it responds with a payload in the correct format.
• Test the API and how it interacts with the other APIs and components it’s supposed to interact with.

4. Mirroring API Testing and Production Phase

During the API testing phase, the development teams need to create identical conditions like the one in the production. This will ensure that the APIs function accurately and will allow testing bug fixes, performance bottlenecks and important security bugs in an environment similar to the one the customers are facing.

5. Keep track of API Responses and save them for future use.

Many testers on the success or failure of each API, discard the set of responses after they’ve finished running their functional tests. This is wrong, as responses from an API are very useful data that can be used for comparing the inconsistency or error caused in future builds. This can help testers to figure out exactly which modification is causing the error. Without recording these test results, important history is lost.

6. Test Positive and Negative Scenarios

As a tester, we often think about the “Happy Path”- the path that the user will most likely take when they are using our application. We often perform API testing to verify that every endpoint returns a “200 OK” or similar successful response.
It’s equally important to think about negative testing as it can expose improperly handled errors that could impact a user. By performing negative testing, a tester can see whether or not their API can deal with receiving incorrect or invalid data with an error message instead of a hard crash. This will improve the efficiency of the application and help the app to respond in scenarios where invalid data is provided.

7. Never Ignore Security Tests

API allows data exchange between applications. If a hacker breaches API security, he/she can access sensitive data stored on the website. In order to protect applications from exploitation and security breaches, all APIs must be tested for security flaws and exploits. This can be performed using various testing tools that help to run and scan security tests with some extra features.