API Testing Practice: Free REST API with Auth and 141 Scenarios

# 1. Read hardcoded data (no auth)
curl -i https://sqatools.in/wp-json/sqa-api/v1/users/1

# 2. Create a temporary object that lives 120 seconds
curl -i -X POST https://sqatools.in/wp-json/sqa-api/v1/objects \
  -H "Content-Type: application/json" \
  -d '{"name": "My test object", "data": {"qty": 2}, "ttl": 120}'

# 3. Basic auth
curl -i -u sqa_user:sqa@123 https://sqatools.in/wp-json/sqa-api/v1/basic/profile

# 4. API key
curl -i -H "X-API-Key: sqa-key-12345" https://sqatools.in/wp-json/sqa-api/v1/apikey/profile

# 5. Bearer token: log in, then send the access_token
curl -s -X POST https://sqatools.in/wp-json/sqa-api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "admin@123"}'
curl -i -H "Authorization: Bearer <access_token>" https://sqatools.in/wp-json/sqa-api/v1/auth/me

import requests

BASE = "https://sqatools.in/wp-json/sqa-api/v1"

# No auth: hardcoded user
r = requests.get(f"{BASE}/users/1", timeout=10)
print(r.status_code, r.json()["data"]["name"])          # 200 Asha Verma

# Create a temporary object, then read it back from the Location header
r = requests.post(f"{BASE}/objects", json={"name": "My test object", "ttl": 120}, timeout=10)
print(r.status_code, r.headers["Location"])             # 201 …/objects/obj_…
print(requests.get(r.headers["Location"], timeout=10).json()["name"])

# Basic auth, API key and Bearer token
print(requests.get(f"{BASE}/basic/profile", auth=("sqa_user", "sqa@123"), timeout=10).status_code)
print(requests.get(f"{BASE}/apikey/profile", headers={"X-API-Key": "sqa-key-12345"}, timeout=10).status_code)
token = requests.post(f"{BASE}/auth/login", json={"username": "admin", "password": "admin@123"}, timeout=10).json()["access_token"]
print(requests.get(f"{BASE}/auth/me", headers={"Authorization": f"Bearer {token}"}, timeout=10).json()["data"]["role"])

const BASE = 'https://sqatools.in/wp-json/sqa-api/v1';

// No auth: list users, page 2, 5 per page
const list = await fetch(`${BASE}/users?page=2&per_page=5`);
console.log(list.status, list.headers.get('X-Total-Count'));   // 200 '12'

// Create a temporary object
const created = await fetch(`${BASE}/objects`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ name: 'From fetch', data: { qty: 2 }, ttl: 120 })
});
const obj = await created.json();
console.log(created.status, obj.id, obj.version);               // 201 'obj_…' 1

// Bearer token
const login = await fetch(`${BASE}/auth/login`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ username: 'viewer', password: 'viewer@123' })
});
const { access_token } = await login.json();
const me = await fetch(`${BASE}/auth/me`, { headers: { Authorization: `Bearer ${access_token}` } });
console.log((await me.json()).data.can_write);                  // false

import pytest
import requests

BASE = "https://sqatools.in/wp-json/sqa-api/v1"


@pytest.fixture(scope="session")
def admin_headers():
    r = requests.post(f"{BASE}/auth/login", json={"username": "admin", "password": "admin@123"}, timeout=10)
    assert r.status_code == 200
    return {"Authorization": f"Bearer {r.json()['access_token']}"}


def test_get_user():
    r = requests.get(f"{BASE}/users/1", timeout=10)
    assert r.status_code == 200
    assert r.headers["Content-Type"].startswith("application/json")
    assert r.json()["data"]["email"] == "asha@example.com"


@pytest.mark.parametrize("user_id, status", [(1, 200), (12, 200), (13, 404), ("abc", 400)])
def test_user_ids(user_id, status):
    assert requests.get(f"{BASE}/users/{user_id}", timeout=10).status_code == status


def test_pagination():
    body = requests.get(f"{BASE}/users", params={"page": 3, "per_page": 5}, timeout=10).json()
    assert [u["id"] for u in body["data"]] == [11, 12]
    assert body["meta"]["total_pages"] == 3
    assert body["links"]["next"] is None


def test_object_lifecycle():
    r = requests.post(f"{BASE}/objects", json={"name": "Laptop", "data": {"ram": "16GB"}, "ttl": 120}, timeout=10)
    assert r.status_code == 201
    url = r.headers["Location"]

    r = requests.patch(url, json={"data": {"ram": "32GB"}}, timeout=10)
    assert r.status_code == 200
    assert r.json()["data"] == {"ram": "32GB"}
    assert r.json()["version"] == 2

    assert requests.delete(url, timeout=10).status_code == 204
    assert requests.get(url, timeout=10).status_code == 404


def test_validation_errors():
    r = requests.post(f"{BASE}/validate/user", json={"name": "A", "email": "bad", "age": "20"}, timeout=10)
    assert r.status_code == 422
    fields = {d["field"] for d in r.json()["error"]["details"]}
    assert fields == {"name", "email", "age"}


def test_basic_auth():
    assert requests.get(f"{BASE}/basic/profile", auth=("sqa_user", "sqa@123"), timeout=10).status_code == 200
    r = requests.get(f"{BASE}/basic/profile", auth=("sqa_user", "wrong"), timeout=10)
    assert r.status_code == 401
    assert r.headers["WWW-Authenticate"].startswith("Basic")


def test_api_key():
    assert requests.get(f"{BASE}/apikey/profile", headers={"X-API-Key": "sqa-key-12345"}, timeout=10).status_code == 200
    assert requests.get(f"{BASE}/apikey/profile", headers={"X-API-Key": "wrong"}, timeout=10).status_code == 403


def test_token_crud(admin_headers):
    r = requests.post(f"{BASE}/token/objects", json={"name": "Secured"}, headers=admin_headers, timeout=10)
    assert r.status_code == 201
    assert r.json()["created_by"] == "admin"


def test_timeout_is_raised():
    with pytest.raises(requests.exceptions.Timeout):
        requests.get(f"{BASE}/delay/5", timeout=2)

import pytest
from playwright.sync_api import APIRequestContext, Playwright

# base_url must end with "/" and paths must not start with "/", or the /wp-json/... part is dropped
BASE = "https://sqatools.in/wp-json/sqa-api/v1/"


@pytest.fixture(scope="session")
def api(playwright: Playwright):
    ctx = playwright.request.new_context(base_url=BASE)
    yield ctx
    ctx.dispose()


@pytest.fixture(scope="session")
def viewer_token(api: APIRequestContext):
    r = api.post("auth/login", data={"username": "viewer", "password": "viewer@123"})
    assert r.ok
    return r.json()["access_token"]


def test_users_page_2(api: APIRequestContext):
    r = api.get("users", params={"page": 2, "per_page": 5})
    assert r.status == 200
    assert r.headers["x-total-count"] == "12"
    assert [u["id"] for u in r.json()["data"]] == [6, 7, 8, 9, 10]


def test_put_creates_then_replaces(api: APIRequestContext):
    r = api.put("objects/pw-demo-object", data={"name": "First", "ttl": 60})
    assert r.status in (200, 201)
    r = api.put("objects/pw-demo-object", data={"name": "Second", "ttl": 60})
    assert r.status == 200
    assert r.json()["name"] == "Second"


def test_conditional_get(api: APIRequestContext):
    etag = api.get("products/101").headers["etag"]
    assert api.get("products/101", headers={"If-None-Match": etag}).status == 304


def test_viewer_is_read_only(api: APIRequestContext, viewer_token):
    auth = {"Authorization": f"Bearer {viewer_token}"}
    assert api.get("token/objects", headers=auth).status == 200
    r = api.post("token/objects", headers=auth, data={"name": "Not allowed"})
    assert r.status == 403
    assert r.json()["error"]["code"] == "forbidden"


def test_basic_auth_with_http_credentials(playwright: Playwright):
    ctx = playwright.request.new_context(base_url=BASE, http_credentials={"username": "sqa_user", "password": "sqa@123", "send": "always"})
    assert ctx.get("basic/profile").status == 200
    ctx.dispose()