API Testing — extended approach and load practices

Course overview

Description generated based on course syllabus and open data.

The content systematizes API testing for REST/SOAP/GraphQL, tools such as Postman, SoapUI, JMeter, Proxyman, and Cypress, plus JavaScript and Python approaches with CI/CD integration. It includes correctness checks, security, and performance.

Who API testing fits and who it does not

Suitable for

• QA Automation — to automate API checks, integrate into CI/CD, and run load testing.
• QA Manual — to deepen understanding of HTTP, contracts, documentation, and optimize test cases.
• Developers — to diagnose integrations and microservices, and analyze logs and traces.

Not suitable

• if only basic UI checks are required without API work;
• if scripting in JavaScript or Python is not feasible;
• if CI/CD, security, or performance aspects are out of scope.

API issues → results of testing approaches

• Issue: unstable service integrations (contracts, compatibility).
  Approach result: procedures for contract testing, schema validation (JSON Schema), and version checks.
• Issue: late defect detection at the UI level.
  Approach result: shift‑left: API testing before UI, faster feedback in the pipeline.
• Issue: unknown performance limits.
  Approach result: load/stress scenarios in JMeter, latency and throughput metrics.
• Issue: access risks and data exposure.
  Approach result: checks of authentication/authorization, negative scenarios, OWASP API focus.

Comparing approaches in API testing

• Self‑study of docs: flexible, yet gaps in practices and no feedback loop.
• Service unit tests only: fast feedback, but limited for integrations, security, and load.
• UI‑centric testing: valuable for end‑to‑end, but slow/fragile for API contracts.
• Systematic API testing approach: combines REST/SOAP/GraphQL, automation (Postman/Newman, SoapUI, Cypress), performance (JMeter), security, and CI/CD.

Competencies and outcomes in API testing

• Plan checks for API correctness and stability (REST, SOAP, GraphQL).
• Create and automate requests in Postman and SoapUI; run collections via Newman; inspect traffic with Proxyman.
• Conduct load and stress testing in JMeter with metric interpretation.
• Integrate API tests into CI/CD (GitHub Actions, GitLab CI, Jenkins as needed).
• Script with JavaScript and Python for checks, utilities, and fixtures.
• Security checks: authentication, authorization, access control, basic OWASP API practices.
• Maintain documentation, contracts, and reporting artifacts.