Path Parameters vs Query Parameters, Pagination, Filtering and Sorting

Open any shopping app, search “headphones”, filter by price, sort by rating and scroll to page 3. Every one of those taps changes the parameters of an API call. Parameters are where a huge share of API bugs hide: off-by-one pagination, filters that ignore case, sorting that silently fails, and ids that let you read someone else’s data. This lesson explains path vs query parameters and gives you a complete test design for pagination, filtering, sorting and search, all runnable on the practice API.

Path vs Query Parameters (with a Library Example)

There are two more places for data: headers (metadata such as auth) and the request body (the payload for POST/PUT/PATCH). Some older APIs also use matrix parameters (;color=red), but you’ll rarely see them.

Testing Path Parameters

Path parameters look simple, but they carry some of the worst bugs, including the number one API security risk.

curl -i \
  "https://sqatools.in/wp-json/sqa-api/v1/users/0"

Pagination: Why APIs Split Data into Pages

Amazon can’t return 50 million products in one response. Pagination returns a small slice at a time. The three common styles:

The practice API has 12 users and uses page-based pagination. It returns the page details in both the body (meta, links) and headers (X-Total-Count, X-Total-Pages, Link).

curl -i \
  "https://sqatools.in/wp-json/sqa-api/v1/users?page=2&per_page=5"

Page 2 with 5 per page must start at the 6th record (id 6) and contain ids 6 to 10.

Pagination Test Cases (Boundary Value Analysis)

Filtering

Filters narrow a collection. Test each filter alone, in combination, with invalid values and with edge cases such as case sensitivity.

curl -i \
  "https://sqatools.in/wp-json/sqa-api/v1/products?min_price=5000&max_price=100"

Sorting

Why the whitelist matters: if sort is pasted directly into SQL (ORDER BY {sort}), it is an injection point. A 400 for unknown fields is the secure behaviour.

Search

• Match: /users?q=gupta returns Manish Gupta.
• No match: /users?q=zzz returns 200 with an empty list, not 404.
• Partial and case: “GUP”, “gup” behave as documented.
• Special characters: %, _, ', emojis, Hindi text (?q=%E0%A4%86%E0%A4%B6%E0%A4%BE) don’t cause 500.
• Long input: 5,000 characters is rejected cleanly.
• Search + filter + pagination together.

URL Encoding: The Silent Bug Source

Query values containing spaces or special characters must be URL-encoded: a space becomes %20 (or +), & becomes %26, @ becomes %40.

Postman and Playwright’s params option encode values for you; hand-built URL strings don’t.

Automating Parameter Tests with Playwright

import { test, expect } from '@playwright/test';

const BASE = 'https://sqatools.in/wp-json/sqa-api/v1';

test('page 2 starts at the 6th record', async ({ request }) => {
  const res = await request.get(`${BASE}/users`, { params: { page: 2, per_page: 5 } });
  const body = await res.json();
  expect(body.data.map((u: any) => u.id)).toEqual([6, 7, 8, 9, 10]);
  expect(body.meta).toMatchObject({ page: 2, per_page: 5, total: 12, total_pages: 3 });
});

test('walking all pages returns 12 unique users', async ({ request }) => {
  const ids: number[] = [];
  for (let page = 1; ; page++) {
    const body = await (await request.get(`${BASE}/users`, { params: { page, per_page: 5 } })).json();
    if (body.data.length === 0) break;
    ids.push(...body.data.map((u: any) => u.id));
  }
  expect(ids).toHaveLength(12);
  expect(new Set(ids).size).toBe(12);   // no duplicates
});

test('every filtered user is an admin', async ({ request }) => {
  const body = await (await request.get(`${BASE}/users`, { params: { role: 'admin', per_page: 50 } })).json();
  expect(body.data.length).toBeGreaterThan(0);
  for (const u of body.data) expect(u.role).toBe('admin');
});

test('sorted by age descending', async ({ request }) => {
  const body = await (await request.get(`${BASE}/users`, { params: { sort: 'age', order: 'desc', per_page: 50 } })).json();
  const ages = body.data.map((u: any) => u.age);
  expect(ages).toEqual([...ages].sort((a, b) => b - a));
});

for (const bad of ['per_page=51', 'page=0', 'active=maybe', 'sort=salary', 'order=up']) {
  test(`invalid query ${bad} -> 400`, async ({ request }) => {
    expect((await request.get(`${BASE}/users?${bad}`)).status()).toBe(400);
  });
}

Interview Questions: Parameters and Pagination