What is API Testing?

API testing operates at the service layer, bypassing the UI to test business logic directly. This makes it faster, more stable, and more targeted than E2E testing. A comprehensive API testing strategy covers functional testing (correct responses for valid inputs, appropriate errors for invalid inputs), contract testing (response schema matches the documented specification), security testing (authentication, authorization, injection attacks, rate limiting), performance testing (response times, throughput under load), and negative testing (malformed requests, missing required fields, boundary values).

For REST APIs, testing involves verifying HTTP methods (GET, POST, PUT, DELETE), status codes (200, 201, 400, 401, 404, 500), response bodies (JSON schema validation, data correctness), headers (content-type, cache-control, CORS), and idempotency. For GraphQL, testing focuses on queries, mutations, error handling, N+1 query detection, and depth limiting.

Tools like Postman (manual and automated), REST Assured (Java), SuperTest (Node.js), and pytest with requests (Python) are industry standards. Many teams maintain Postman collections or OpenAPI specifications as the source of truth for API behavior, enabling automated contract validation.