Deepak Nangla
Kunal Jagota
These days everyone around is looking for easy, reliable and fast pace solutions to simplify their business operations and in this pursuit they are in continuous search of latest trends & technology that can also keep the quality of their business applications intact!!
API testing is the testing in which the functionality, security and performance of the interfaces are verified. API testing is completely different from Application testing which primarily focuses on the look, feel and functionality of the software. As API testing focuses just on the functionality, we send calls to APIs in order to retrieve or send data and note down the response time. To test APIs, there are multiple tools in the market and one of my personal favorites is POSTMAN which helps to test almost every aspect which is needed to cover. While testing APIs, we ensure that it returns the desired output for a given input and handles errors when the results are not as per expectations.
API testing is most beneficial during production releases when it is really important to verify that all the existing functionality is working well and nothing is getting broken. In such cases, it is helpful if we monitor APIs to ensure that all API endpoints are working correctly and response time of APIs is within the expected time frame-This way, testing teams can easily identify where the actual issue lies if anything breaks down. Thus, can be fixed as soon as possible.
Load & Performance Testing
Performance Testing is generally used to determine limitations of an application working under a given load which further helps to make an application stable, scalable and fast. API testing helps to check how a system behaves when multiple requests are made to a server.
There are various API tools which help in processes, like API fortress, loadium with postman, moreover, another benefit of doing it with an API tool is that it does both functional and performance testing simultaneously.
API fortress – It is an automated testing tool which helps in monitoring APIs with or without CI-CD pipeline and can be beneficial in various ways such as while doing load testing of the API – https://apifortress.com/doc/load-testing/
It’s Faster Than GUI Testing
API testing is not only more comprehensive but it is also faster than GUI testing. For instance where 30 minutes are needed to test 1,000 API cases it can take approx 3-5 hours to test 1,000 GUI cases. Thus, it is safe to conclude that API testing helps to identify the bugs quickly and gives a good test coverage.
According to Katalon, a well known automation testing tool, API testing is faster than GUI testing as the web elements in GUI testing are polled, which makes the testing process slower. API test automation requires less code so it can provide better and faster test coverage compared to GUI test automation.
Easy To Maintain Test Case
As we know the changes which are made to the front end of the application are usually quite frequent so if we have to automate testing of GUI, it will take significantly more time and effort. On the other hand, APIs usually require relatively minimal changes as it revolves around the business logic of the product. So once the test cases have been prepared, it’s beneficial to automate the testing of APIs and then run multiple test cases to verify the response via the following three aspects and thereby saving a lot of time.
- Is it providing expected status code or not?
- Verify the response time
- Verify if it is providing the expected set of values in the output or not.
Security Testing
Data is the center point of all businesses and protecting it against security threats is a high priority for them. However, data can become vulnerable via APIs as it involves data exchange between two applications. Thus, to prevent data leakage from any application we need to prepare a basic checklist which needs to be tested and only those APIs should be released. Here are some of the rules and checks which can be performed:
- If your API expects numbers in the input, try to send values such as negative numbers, 0, and large digit numbers.
- Test for authentication on all endpoints.
- Basic authentication shouldn’t be used as it uses HTTP method and submits data in an unencrypted format.
- Maximum retry should be implemented – to ensure if any hacker tries to login with multiple combinations and gets failed then that IP address should be blocked for a certain amount of time.
- Test for parameter tampering – Suppose there is a shopping website having a product of $100 and for that if there is any hidden field for price in the form and the hacker using the inspect element changes the value of that product from $100 to $1 he can then buy that product at $1.
Conclusion
There is no single fit approach to do API testing, but following certain practices and keeping checkpoints in place will always help! It can be safely concluded that API testing has an edge over other techniques when it comes to maintaining product quality. Also, for further complex and more detailed scenarios, API testing helps in achieving maximum test coverage by widening the scope.
nice read.
I like using postman very much.
Check out K6 for performance testing. Why because it is free, developer friendly, gives you percentiles of results like 75% of the traffic took x seconds.
And checkout newman with postman. Newman is an awesome tool if you want to integrate API testing in Automation. https://blog.codestellar.net/2019/09/using-newman-client-for-api-testing.html