API Testing

Learning objectives#

• Send GET, POST, PUT and DELETE requests with curl
• Organise requests in a Postman collection with variables
• Write simple Postman test scripts
• Cover happy paths, errors, auth and limits for every endpoint

Explanation#

curl ships with Windows 10+, macOS and Linux. -X sets the method, -H adds headers, -d sends a body, -i shows response headers.

Postman (or Insomnia, or Visual Studio’s .http files) saves requests in collections. Environment variables such as {{baseUrl}} and {{token}} let the same collection run against local, staging and production.

Postman test scripts run after each request: pm.test("status is 201", () => pm.response.to.have.status(201)). Run the whole collection with the Collection Runner or Newman in CI.

Swagger UI’s “Try it out” is a quick way to test while reading the docs.

For every endpoint, test: the happy path, invalid input (400), missing auth (401), wrong role (403), unknown id (404), conflicts (409) and limits (page size, file size).

Syntax#

1// Postman → Tests tab for POST {{baseUrl}}/api/products
2pm.test("returns 201", () => pm.response.to.have.status(201));
3pm.test("has a Location header", () => pm.response.to.have.header("Location"));
4pm.test("returns the new id", () => {
5  const body = pm.response.json();
6  pm.expect(body.Id).to.be.a("number");
7  pm.environment.set("productId", body.Id);   // reuse in the next request
8});

Code example: A curl session against the Shop API#

1# 1. Sign in and get a token
2curl -s -X POST https://localhost:44300/token -d "grant_type=password&username=asha&password=P%40ssw0rd!"
3

4TOKEN="paste-the-access_token-here"
5

6# 2. Happy path: read a product (with headers shown)
7curl -i https://localhost:44300/api/products/1 -H "Authorization: Bearer $TOKEN"
8

9# 3. Create a product
10curl -i -X POST https://localhost:44300/api/products -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"Name":"Bag","Price":650,"Stock":5,"Category":"Bags"}'
11

12# 4. Invalid input
13curl -i -X POST https://localhost:44300/api/products -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"Name":"","Price":-1}'
14

15# 5. No token
16curl -i https://localhost:44300/api/products/1
17

18# 6. Delete, then delete again
19curl -i -X DELETE https://localhost:44300/api/products/2 -H "Authorization: Bearer $TOKEN"
20curl -i -X DELETE https://localhost:44300/api/products/2 -H "Authorization: Bearer $TOKEN"

1 → {"access_token":"Ah3k...","token_type":"bearer","expires_in":3599}
2 → HTTP/1.1 200 OK   Content-Type: application/json; charset=utf-8   {"Id":1,"Name":"Pen",...}
3 → HTTP/1.1 201 Created   Location: https://localhost:44300/api/products/2
4 → HTTP/1.1 400 Bad Request   {"Message":"The request is invalid.","ModelState":{...}}
5 → HTTP/1.1 401 Unauthorized
6 → HTTP/1.1 204 No Content, then HTTP/1.1 404 Not Found

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

1. The token request uses a form-encoded body, as the OWIN /token endpoint expects (%40 is @).
2. Storing the token in a shell variable keeps later commands short.
3. -i prints status line and headers, so you can check Location, Content-Type and caching headers.
4. Requests 4 and 5 deliberately break the rules to check the error responses.
5. Deleting twice confirms DELETE is idempotent: 204, then 404.

Real-world use case#

Common mistakes#

Best practices#

• Save every request you send in a collection
• Use variables for base URL and token
• Add test scripts for status and key fields
• Run the collection in CI

Remember this#

Practice exercise#

1curl -i -X PUT https://localhost:44300/api/products/1 -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"Name":"Gel Pen","Price":25,"Stock":40,"Category":"Stationery"}'
2

3curl -s "https://localhost:44300/api/products?page=2&pageSize=5" -H "Authorization: Bearer $TOKEN"
4

5curl -s "https://localhost:44300/api/products?page=1&pageSize=1000" -H "Authorization: Bearer $TOKEN"
6# expect "PageSize":100 in the response

Mini quiz#

Want more? Practise all ASP.NET Web API MCQs · ASP.NET Web API interview questions

Related topics#

My notes#

Saved in this browser.