Why APIs deserve first-class testing
APIs often contain business logic and integration contracts below the UI. They usually provide faster and more stable automation than browser-only testing.
Core API coverage
- Methods
- Status codes
- Headers
- Schema
- Business rules
- Authentication
- Authorization
- Error handling
- Idempotency
- Rate limits
Positive and negative testing
POST /orders — positive
Valid customer + active product + authorized token → order created, correct response, persisted state, downstream event.
Negative examples
Missing field, malformed JSON, invalid state, unauthorized token, forbidden role, duplicate request, dependency timeout.
Idempotency and dependencies
POST payment
↓
Network timeout
↓
Client retries same request
↓
System recognizes duplicate
↓
ONE payment, not two
Mocks and service virtualization can create repeatable dependency states, but they should complement—not eliminate—real integration testing.