A handbook on API Testing to Improve Software Testing

 

API testing is many a time among the most challenging and critical parts of software testing because APIs can be complicated, they are generally based on protocols that we frequently do not encounter in other forms of testing.

 

While a lot of developers mostly check only for the basic functionality of the application which they are assigned to work on, testers are responsible for testing the complete overall functionality of the application, including performance as well as security of APIs, discovering how all components work together from end to end of an application.

 

Here we’re diving deep into API testing to know how it can increase the quality of an application and increase your test coverage.

 

What is API testing and why it’s important?

 

 

In a traditional three-tier architecture, APIs server as a middle layer of an application. They control the business logic and connect the GUI and Database layer.

 

Basically API testing is expected to uncover any bugs, inconsistencies or discrepancies from the expected behavior of the software.

 

Earlier testing used to be done mostly at the User Interface layer by using the application’s interface and testers could find bugs in the business logic only by testing through UI. But to start the testing process testers had to wait for developers to finish the UI development completely. This somehow slowed down the testing process and increased the costs of fixing the bugs at a later stage.

 

Agile development and test automation make this approach progressively outdated. Now developers mostly create applications by writing the APIs first. And once the business logic is prepared, they design a UI around it creating the user experience.

 

By testing at the API layer testers or developers can find the logic-related or major functionality bugs much earlier and fix them immediately for a fraction of costs in the early stage of development.

 

Here are some of the foremost common reasons people test their APIs:

1. Make sure your API does what it is expected to do

2. Make sure the API can handle the load

3. Find all the ways users can wreck things up

4. Make sure your APIs work across devices, browsers, and operating systems

 

How is API testing done?

 

Basically API testing involves sending API calls and in return checking responses. An API can return data in several formats of which JSON and XML are the most popular ones. Return data also has HTTP response codes, a Pass/Fail status or a call to other APIs.

 

Before you start testing your APIs you must know what kinds of requests users can make as well as their limitations.

 

To make sure whether your API is according to the expected functionality, you’ll have to write the test cases that include:

• Input parameters
• Expected responses
• Max response time
• Parsing inputs
• Error handling
• Correct formatting of the response
• Add each test case to your script and execute it after each new build as a regression.

What You Need To Start API Testing

 

You can start the API testing by first configuring a testing environment with the specified set of parameters around the API. This involves configuring the database and server as per the application’s requirements.

Once you have configured the environment for API testing make a simple API call to make sure it is working as expected and nothing is broken before you go forward to start your more in-depth testing. Then you can start comparing the application's expected data with your API tests response to make sure that the API performs as expected with the available inputs.

The types of tests you will run will be possibly different but these are some common API test examples, as you can see these are very basic reasons why you would want to test your APIs:

• • Checking API return response based on the input condition.
• • Checking if the API does not return anything or the wrong results.
• • Checking if the API response has calls to some other API.

 

Next, you need to adjust yourself around the API test. Start by asking yourself these questions:

• • Who is your target audience?
• • In which environment should the API typically be used?
• • What aspects are we testing?
• • What problems are we testing for?
• • What are your priorities to test?
• • What is supposed to happen in normal situation?
• • What could potentially happen in abnormal situation?
• • What is defined as a Pass or a Fail criteria? What is the desired output?
• • What other APIs could this API interact with in response?

 

After identifying this testing borderline and requirements, you need to decide

 

What Types of API Testing Can I Do?

 

• Functionality testing — Includes testing particular functionality in the application. The API should work and does exactly what it’s supposed to do.

• Reliability testing — To check whether the API is giving you prompt and consistent response every time when you test for different configurations. To check if the API response returns any exception handling errors or any timeout errors etc.

 

• UI Testing – Testing the user interface it focuses more on the interface which ties into the API rather than testing the API itself.

• Load testing — To ensure an API can handle a large number of calls and expected loads. This way we can identify the bottlenecks in the application regarding more user traffic.

• Security testing — This ensures that the API implementation is secure from external threats. The API has defined security requirements including authentication, encryptions, permissions, and access controls.

• API documentation testing — it can also be called discovery testing as the API documentation easily guides the user about the structure and flow of the API working.

• Negative Testing — here checking for every kind of wrong input the user can possibly supply to the application and identifying if API is behaving as expected with wrong inputs.

• Validation Testing - Validation testing is among the last steps and plays an essential role in the process. It is done typically after verification of functional APIs. It verifies the aspects such as product, behavior, and efficiency. Basically validation testing can be seen as an assurance of the correct development.

Best Practices for API Testing

 

Before you head off and get started with API testing by yourself here are the 10 tips to remember when doing API testing!

1. Test for the standard or expected results first

2. Add stress/load to the system through a series of API load tests

3. Test for failure, make sure you understand how your API will fail and keep in mind that API fails consistently and gracefully

4. Group your test cases according to test category.

5. Prioritize API function calls as per the requirement so that it will be easy for testers to test quickly and easily

6. Limit the tests from as many variables as possible by keeping it as isolated as possible

7. See how it handles unforeseen problems and loads.

8. Perform well-planned call sequencing

9. For complete test coverage, create test cases for all possible API input combinations

10. Automate wherever you can

 

Manual Testing vs. Automated Testing

 

You can perform Manual and Automated testing using the available testing tool, like Postman and SoapUI. You can combine the requests you’ve created into a single automated test sequence and then run and manage the workflow.

API testing is one of the areas where automated testing is highly suggested especially in the world of agile development and continuous delivery cycles. Tests are automated by creating test suites which has multiple test scripts that can run again and again.

You should consider using manual testing when performing the following tests:

• Exploratory testing

• Usability testing

• Ad-hoc testing

 

You should consider implementing automated testing for the following:

• API functional testing

• Dynamic testing

• Repeated test design

• Performance testing

• Data-driven testing

• Load testing

• Error testing

• Testing in multiple languages

• Regression testing

 

We can continue doing API usability testing as a manual testing priority to create a better, simpler, developer experience.

 

If you're looking for a quick and easy manual testing experience, there is one simpler and easy-to-use tool as 'Swagger Inspector'. It's a super easy-to-use testing tool that you can use right away in your browser.

API testing tools

 

There are many tools available that can assist you to test your APIs. But we prefer Postman for manual API testing and SoapUI for automated API testing.

Postman is one among the most popular tool for ad-hoc and exploratory testing with quite 5 million testers.

 

It’s an easy and simple REST client that comes within the sort of a Chrome extension as well as desktop apps for Windows, Linux, or Mac.

 

Unlike most similar tools Postman has a superb and easily understandable UI. This makes it an excellent choice for testers who don’t want to urge cover down in coding.

You can run API tests in privacy using Postman’s request builder or create collections of multiple tests.

 

Postman supports easy knowledge sharing and collaboration with you team mates or colleagues. You can also upload the test cases to your knowledge base or package API calls and the therefore the expected responses into a collection set and send it to your colleagues.

The tool also allows you to make Boolean tests, extract data from lastest web APIs and even automate your tests. Among its neat features there are also support for multiple environments (e.g. development, staging, etc.) and REST requests.

 

Wrapping up here!

 

And that just about it for API testing. It’s time to think about the advantages it can provide to your organization against its costs.

 

It can be the potential savings from fixing bugs early which make up for the larger QA budget. It will increase the test coverage and accuracy add enough value to your product. And at the last you can identify the risk of releasing an insecure app.

 

Now that you understand what is API testing and its value to your testing process, what’s next? You can start Testing you APIs!