Software Testing & QA
API Testing and Automation
Test REST APIs like a professional: HTTP fundamentals, schema and boundary validation, chained workflows, security basics, and a maintainable automation structure.
Helpful before you begin (optional -- you can start this course now): Software Testing Foundations
Who it's for
Testers who've completed Software Testing Foundations (or already know its core techniques) and want to apply them specifically to REST APIs, plus developers who want to test their own APIs more rigorously.
What you'll be able to do
- Explain HTTP status codes, REST conventions, and the difference between authentication and authorization
- Validate a JSON response's schema and design both positive and negative test cases
- Apply boundary-value analysis to API-specific shapes: field limits, empty collections, and pagination
- Test chained, multi-step workflows and validate error responses rigorously
- Check for baseline API security issues like broken object-level authorization and unsafe input handling
- Structure an isolated, maintainable test automation suite with useful CI reporting
Not started — 14 lessons, no account required.
Start this coursePractice this course →Add to a study plan →Interview questions →
HTTP and REST foundations
The shape of every request and response, and the conventions real APIs follow.
- 18 min
HTTP Fundamentals: Requests, Responses, and Status Codes
The shape of every HTTP request and response, and the status code ranges every API tester needs memorized cold.
- 17 min
REST Conventions and Resource Design
The conventions real REST APIs follow for URLs and HTTP methods, and how to spot when an API breaks its own conventions.
Requests, auth, and validation
Headers, authentication vs. authorization, and checking a response's full shape.
- 17 min
Headers and Authentication Concepts
What headers actually do, and the difference between authentication and authorization — two failures that look identical to an untrained eye.
- 24 min
Validating JSON Responses Against a Schema (Lab)
A hands-on lab: check a response's actual shape against what it's supposed to be — field presence, correct types, and nothing extra or missing.
Designing test cases
Positive and negative testing, API-specific boundaries, and contract compatibility.
- 18 min
Positive and Negative API Testing
Confirming an API does what it should is only half the job. Negative testing confirms it correctly refuses what it shouldn't allow.
- 22 min
Boundary Cases for API Inputs (Lab)
A hands-on lab: apply boundary-value analysis specifically to API payloads — numeric limits, string lengths, array sizes, and pagination edges.
- 18 min
Contract Testing Concepts
How teams keep an API's consumers and provider in sync without one giant end-to-end test suite for every possible combination.
Advanced testing patterns
Scaling test cases, testing multi-step workflows, and validating errors rigorously.
- 18 min
Data-Driven API Testing
Separate the test logic from the test data, so adding a new case is a one-line data change instead of writing a whole new test.
- 24 min
Chained Requests and Stateful Workflows (Lab)
A hands-on lab: test a realistic multi-step workflow where each request depends on data returned by the one before it.
- 17 min
Validating Error Responses
An error response deserves the same careful scrutiny as a success response — the right status code, a genuinely useful body, and no leaked internals.
Reliability and security
Safe retries, rate limiting, and the security checks every tester can perform.
- 18 min
Idempotency and Rate-Limit Behavior
Why sending the same request twice should sometimes be perfectly safe, and how to test an API's rate limiting without a real load-testing tool.
- 18 min
API Security Basics for Testers
Concrete, non-specialist security checks every API tester should reflexively perform, without needing to be a penetration tester.
Automation in practice
Structuring a maintainable suite and making CI failures actually actionable.
- 18 min
Structuring an API Test Automation Suite
Organize test code the way real automation frameworks do: setup and teardown, isolated test data, and no test that depends on another test running first.
- 19 min
Reporting and CI Concepts
Automated tests only pay off if a failure is visible and actionable — how continuous integration runs them automatically, and what a genuinely useful test report looks like.