What Is API Testing? A Beginner’s Guide with Real-Life Examples

Every time you pay with UPI, track a Swiggy order or check the weather on your phone, dozens of APIs talk to each other behind the screen. If one of them sends wrong data, the app breaks, even when the screen looks perfect. In this lesson you will learn what API testing is, why companies depend on it, what exactly a tester checks, and you will send your first real API request on a free practice API.

What is an API? (The Restaurant Waiter Example)

API stands for Application Programming Interface. It is a contract that lets one piece of software ask another piece of software for data or for an action, using a fixed set of rules.

Map that to software:

What Is API Testing?

API testing means acting like the client: you send requests to the API and verify that every response is correct. You are not clicking buttons. You are checking the layer that every button eventually calls.

When you test an API you ask questions like:

• Does GET /users/1 return 200 OK and the right user?
• Does GET /users/999 return 404 Not Found with a clear error message, not a 500 crash?
• Does creating an order with a negative quantity get rejected?
• Can a user without permission delete someone else’s data?
• Does the API answer in under 500 ms when 1,000 users call it together?

Why API Testing Is So Important

Modern applications are built as many small services talking over APIs. A single Flipkart checkout can call the cart service, pricing service, coupon service, payment gateway, inventory and delivery partner APIs. The UI is just a thin layer on top.

Because of this, API testing is one of the most requested skills in QA job descriptions in 2026, for both manual testers and automation engineers.

Real-Life Example: Testing a Food Delivery Order API

Imagine you are the tester for a food delivery app. The developer tells you the new endpoint POST /orders is ready, but the UI will take another two weeks. With API testing you do not wait. You test it today.

1. Happy path: send a valid order with 2 items. Expect 201 Created, an order id, the correct total and status "placed".
2. Calculation check: 2 x Rs 799 + 1 x Rs 349 = Rs 1,947. Add 18% tax and the total must be Rs 2,297.46. (This exact order exists on the practice API as GET /orders/5001.)
3. Negative tests: quantity 0, unknown item id, missing address. Each should return 400 or 422 with a clear message.
4. Security: call without a login token (expect 401), call with another customer’s token for this order (expect 403 or 404).
5. Performance: response time under the agreed SLA, for example 800 ms.

By the time the UI arrives, the business logic is already proven. UI testers only need to check that the screen shows what the API returns.

What Do You Check in API Testing?

You will learn each of these in detail in the next lessons, especially HTTP status codes and HTTP headers.

Your First API Test in 3 Ways

SQA Tools gives you a free practice REST API with no sign-up. Its base URL is https://sqatools.in/wp-json/sqa-api/v1. Let’s fetch user number 1.

1. In the browser (press Send request)

curl -i \
  "https://sqatools.in/wp-json/sqa-api/v1/users/1"

You should see 200 OK and a JSON body with "name": "Asha Verma", "role": "admin" and "city": "Pune". This data is hardcoded, so the response is always the same, which makes it perfect for practising assertions.

2. In Postman (manual testing)

1. Open Postman and click New → HTTP Request.
2. Keep the method as GET and paste https://sqatools.in/wp-json/sqa-api/v1/users/1.
3. Click Send. Check the status (200), time (ms) and body.
4. Now change the id to 999 and send again. You get 404 with the message “User 999 does not exist. Valid ids are 1 to 12.” That is your first negative test.

3. With Playwright and TypeScript (automation)

import { test, expect } from '@playwright/test';

const BASE = 'https://sqatools.in/wp-json/sqa-api/v1';

test('GET /users/1 returns Asha Verma', async ({ request }) => {
  const response = await request.get(`${BASE}/users/1`);

  expect(response.status()).toBe(200);
  expect(response.headers()['content-type']).toContain('application/json');

  const body = await response.json();
  expect(body.data).toMatchObject({ id: 1, name: 'Asha Verma', role: 'admin', city: 'Pune' });
});

test('GET /users/999 returns 404 with a clear message', async ({ request }) => {
  const response = await request.get(`${BASE}/users/999`);

  expect(response.status()).toBe(404);
  const body = await response.json();
  expect(body.error.code).toBe('not_found');
});

Run it with npx playwright test. No browser opens: Playwright’s request fixture sends pure HTTP calls. You will build full frameworks with this later in the course, and you can already read Playwright API testing basics.

Manual vs Automated API Testing

Real teams use both. A tester explores the new endpoint manually in Postman, writes the test cases, then automates the stable ones so they run on every code change.

Popular API Testing Tools in 2026

• Postman: the most popular GUI tool for manual and scripted REST testing; Newman runs collections in CI.
• SoapUI / ReadyAPI: strong for SOAP web services (WSDL) and also supports REST.
• Playwright (TypeScript): one framework for both UI and API automation; fast, parallel and great reports.
• REST Assured: Java library popular in Selenium + Java teams.
• cURL: command-line tool available everywhere; developers often share bugs as cURL commands.
• JMeter and k6: load and performance testing of APIs.
• Swagger UI: interactive documentation where you can try endpoints in the browser.

Common Bugs Found by API Testing

• Wrong status codes, such as 200 OK with an error message inside the body, or 500 for simple invalid input.
• Missing validation: negative prices, ages of 500, emails without “@” accepted.
• Calculation errors in totals, tax, discounts or currency rounding.
• Broken authorization: user A can read or change user B’s orders by changing the id in the URL (called BOLA/IDOR, the number one API security risk).
• Sensitive data leaks, such as password hashes or internal ids in the response.
• Pagination bugs: the last page repeats records or skips one.
• Slow responses or no rate limiting.
• Contract breaks: a field renamed from user_name to username without telling the mobile team.

How to Start Learning API Testing (Roadmap)

1. Understand how an API works: request, response, endpoint.
2. Learn HTTP methods and status codes.
3. Learn JSON and headers.
4. Practise manually with Postman and cURL on the SQA Tools practice API (141 ready scenarios).
5. Learn authentication: Basic, API key, Bearer JWT.
6. Automate with Playwright and TypeScript, then build the 5 projects in this course.
7. Use AI to generate test cases and code faster, and prepare with the interview questions.

API Testing Interview Questions