TestingAPIs is still being built. If something breaks, email support@testingapis.com.

Tutorial

Learn API testing

This tutorial starts with what an API is and ends with load tests and CI pipelines. You don't need to know how to program for the first seven lessons. After that, some examples use JavaScript or Python, and each one is short enough to copy and run.

Every request in the lessons goes to a real API, https://api.testingapis.com.It accepts writes and has endpoints built to fail in specific ways, so you can practise on problems that are hard to reproduce elsewhere. Most examples have a Send button that runs the request from this page. The first lessons use endpoints that need no account; later ones need a free account, and their Send buttons work once you're signed in.

19 lessons3 levelsFree

Beginner

7 lessons

What an API is, how HTTP works, and how to send a request and read what comes back.

  1. 01What an API isClients, servers, and the request you already sent without noticing.
  2. 02Anatomy of a requestMethod, URL, headers and body, and what the server actually receives.
  3. 03Reading a responseStatus codes, response headers and the body.
  4. 04HTTP methodsGET, POST, PUT, PATCH and DELETE, and which of them are safe to repeat.
  5. 05Reading JSONThe six JSON types and the values that trip up tests.
  6. 06Sending requests with curl and PostmanThe two tools you will use every day, and when to pick which.
  7. 07Writing your first test casesExpected results, negative tests, boundary values and equivalence classes.

Intermediate

7 lessons

Testing real endpoints properly: CRUD, validation, auth, headers, and tests written as code.

  1. 08Testing a resource end to endCreate, read, update and delete, and checking that each one really happened.
  2. 09Testing validation and errorsBad input, missing fields, wrong types, and what a good error looks like.
  3. 10Filtering, sorting and paginationThe list endpoint bugs that nobody notices until page 3.
  4. 11Authentication and authorizationBasic auth, API keys, bearer tokens and JWTs, and the difference between 401 and 403.
  5. 12Headers, caching and cookiesContent negotiation, ETags, 304 responses and session cookies.
  6. 13Automating tests with codeTurning manual checks into tests with JavaScript or Python.
  7. 14Schemas and contract testingChecking the shape of a response, and using an OpenAPI document as the source of truth.

Advanced

5 lessons

The failures that only show up in production: timeouts, async work, security holes and load.

  1. 15Timeouts, retries and rate limitsFlaky servers, idempotency keys, 429 responses and how clients should behave.
  2. 16Async jobs, webhooks and streamsTesting work that finishes later, requests the server sends to you, and open connections.
  3. 17Security testing basicsBroken object access, auth bypasses, mass assignment and injection.
  4. 18Performance testingMeasuring latency, reading percentiles and running a small load test.
  5. 19Running tests in CITest data, flaky tests, pipelines and deciding what to test at all.