API Testing & Automation Learning Hub

Beginner to Advanced in just 11 steps

Why Learn API Testing?

API Testing is one of the most valuable and in-demand skills in today’s tech world 🌐. It’s like being the backstage hero 🦸‍♂️ who ensures everything works smoothly behind the scenes. Whether it’s streaming Netflix 🎥, shopping online 🛒, or checking your bank balance 💳, APIs are the invisible wires connecting all these apps. Without them, systems wouldn’t "talk" to each other!

Why Is API Testing Important?

  • 🔌 Connects the Dots: APIs are the backbone of modern apps, enabling communication between systems. Testing them ensures these connections stay seamless.
  • 🚨 Prevents Crashes: Imagine apps crashing during a binge-watching session or shopping spree. API testing avoids these disasters!
  • 🛠️ Boosts Performance: By testing APIs, you optimize app performance and user satisfaction.
  • 💼 High Demand, High Pay: Companies value API testers for their technical problem-solving skills, offering higher salaries compared to traditional testers.

What Makes API Testing a Must-Have Skill?

Here’s why you should consider API Testing as your next big skill:

  • 🤔 It’s Challenging: Solve puzzles and find bugs that others can’t see.
  • 🧩 It’s Versatile: Work on different types of projects, from healthcare to finance, retail, and beyond.
  • 💡 It’s Future-Proof: With APIs being critical to modern software, this skill will stay in demand for years to come.
  • 📈 It Opens Doors: Mastering API testing can lead to roles in automation, performance testing, and even DevOps.

What Will You Learn?

In just 11 sections, you’ll gain everything you need to succeed in real-world projects:

  • 📘 API Basics: Understand what APIs are and how they work.
  • 🤖 Automation Testing: Learn tools and techniques to automate API tests.
  • ✅ Advanced Assertions: Ensure your APIs return exactly what they should.
  • ⚙️ Integration with CI/CD Pipelines: Bring your testing skills to modern DevOps workflows.

By the end, you’ll not only be confident in your API testing skills but also ready to stand out in the competitive job market 🚀.

Why Wait?

API Testing is your ticket to an exciting, well-paying, and future-proof career. Ready to become the tech world’s go-to problem solver? Let’s get started! ✨

Start by reading these two documents!

Step 1: Authentication Setup

Understanding the Project

Imagine you’ve been hired by an auto insurance company 🚗 to help them organize and manage their data. Think of this company as a giant library 📚, where each section holds valuable information about:

  • 👤 Drivers: Names, license numbers, and contact details.
  • 🚘 Vehicles: Make, model, registration numbers, and usage history.
  • 📄 Policies: Coverage types, start and end dates, and premium amounts.
  • ⚠️ Claims: Accidents, repair estimates, and payouts.

The Role of APIs

Instead of flipping through dusty books, the company uses APIs—like virtual librarians 🤖—to quickly fetch, store, or update information in an instant. Each API acts as a gateway, ensuring the company’s data is:

  • Accessible: Teams and partner apps can retrieve the exact information they need, anytime.
  • 🔄 Up-to-date: Any changes to the data are reflected instantly across systems.
  • 🔒 Secure: Only authorized users can access sensitive information.

How APIs Help

Here are some examples of how APIs make managing this data effortless:

  • 👤 Driver API: Retrieves and updates driver information, like names, licenses, and contact details.
  • 🚘 Vehicle API: Stores and fetches vehicle details such as make, model, and registration numbers.
  • 📄 Policy API: Helps manage insurance plans, including coverage details and premium amounts.
  • ⚠️ Claims API: Tracks accidents, repair estimates, and payouts for claims.

Getting Started with API Access

To use these APIs, you’ll need a token 🔑—a special key that allows you to access the system securely. Let’s start by creating a token and unlocking the power of these APIs!

Step 1

Create Token

Step 2

Login to Postman



Step 3

Create an empty Collection by clicking on Plus sign.


Step 4

Create a request


Step 5

Enter URL, Select Request type as Post, enter Body in the body tab and press enter.

URL: https://dev-dj4vuaaxgimt7erd.us.auth0.com/oauth/token
Method: Post
Body
Please make sure to enter your email and password in the body that you have used in Step 1.
{ "client_id": "LjJM2IJnaYIXqkNEVURLr4Lldu2thoIP", "client_secret": "iObYF0cqiC9vvcFK4Nv1iuYLQ3VJM7srTu4bsaabyb1n1NyHiH_jw2IAHDvEMT9Y", "audience": "test", "username": "Your Emails", "password": "Your Password", "grant_type": "password" }

Example


Generating Token in Postman -Video:
Now that we have token to access our APIs, let's read little bit more about the project. Please read these before moving to the next section.

Step 2: First API Request

Let’s Hit Our First API!

By now, you’ve likely read about what APIs are, why we need them, and their amazing benefits. If not, we recommend checking out those documents before moving forward 📖. Once you're ready, let’s dive into hitting our first API using the token we generated in Step 1 🔑!

What Do You Need to Hit the API?

To make your first API request, you’ll need the following details:

  • 🌐 URL: https://generalinsurance-ff4b.restdb.io/rest/driver This is the endpoint where the API resides, specifically designed to fetch driver data.
  • ⚙️ Method: GET This tells the API that we’re requesting data without making any changes.
  • 🔒 Authorization: Bearer {token} This ensures that only authorized users with a valid token can access the API.

What’s Happening Behind the Scenes?

When you send this API request, here’s what happens:

  • 🛠️ The GET method fetches driver information from the server, like names, license numbers, and contact details.
  • 📬 The Authorization header (Bearer token) validates your identity, ensuring secure access.
  • 📊 The server processes your request and sends back the data in a structured format, like JSON.

Ready to Hit the API?

Let’s put these details into action! You can use tools like Postman 🛠️ or your browser’s network inspector to send the request. Once you receive the data, you’ve officially made your first API call! 🚀


Understanding the API URL and Response

The URL we used in this request is our API URL 🌐, where all the APIs for our system are hosted. Each part of this URL has a specific purpose:

  • 🔗 Base URL: https://generalinsurance-ff4b.restdb.io/rest/ This is the common starting point for all our APIs.
  • 🚗 Driver Endpoint: The word driver at the end of the URL specifies that this endpoint is used to access driver-related data.

To access these APIs, we use a token 🔑. This token authenticates you and ensures that the server can process your request securely.

Analyzing the Response

Once you hit the API, you’ll receive a response 📨. Take a moment to go through the data returned by the server. For the driver endpoint, you’ll see information such as:

  • 👤 Name
  • 📧 Email
  • 🔒 SSN (Social Security Number)

But how do we know if this data is correct? 🤔 That’s where testing comes in! In the next sections, we’ll learn how to verify the accuracy of the data and ensure everything is working as expected.

Experiment with a New Endpoint

Now, let’s try something different! Change the word driver in the URL to policy and hit send again 🚀. This will fetch all data related to policies, such as:

  • 📄 Policy Types
  • 📆 Start and End Dates
  • 💵 Premium Amounts

By switching endpoints, you’re exploring how APIs can retrieve different types of data with just a small change in the URL. Pretty powerful, right? 😊


Understanding GET APIs: Fetching Data

If you’ve noticed so far, all we’re doing is fetching data. We’re not creating new data or updating existing data, and there’s a good reason for that!

We’re using GET endpoints/APIs 🔎, which are specifically designed for fetching information. These APIs act like messengers, bringing back data from the server without making any changes to it. They’re perfect for retrieving details without worrying about altering anything accidentally.

Why Are GET APIs Important?

  • 🔍 Safe Retrieval: GET APIs are non-destructive—they only fetch data without changing or deleting anything.
  • 📋 Read-Only Operations: Perfect for viewing information like driver details, policies, or claims without modifying the underlying database.
  • 🔒 Secure Access: Combined with tokens, GET APIs ensure that only authorized users can access sensitive data.

Learn About Key API Endpoints

To take this further, check out the attached document 📄. It includes:

  • 🌐 Details on API Endpoints: Learn how endpoints are structured and how they work.
  • 🚗 Auto Insurance Company APIs: Discover the APIs we’ll be using in this project, such as those for drivers, vehicles, policies, and claims.
  • 🛠️ Use Cases: See real-world examples of how these APIs are used to manage insurance data efficiently.

What’s Next?

As we move forward, we’ll explore APIs beyond GET. You’ll learn how to create, update, and even delete data using other API methods like POST, PUT, and DELETE. For now, dive into the document and get familiar with the endpoints we’ll be working with. Let’s unlock the full power of APIs! 🚀



Exploring API Endpoints

Now it’s time to dive deeper into our API endpoints! 🌐 Change the URL to any of the desired endpoints, such as:

  • 👤 Driver: /driver
  • 📄 Policy: /policy
  • 🚗 Vehicle: /vehicle
  • 💳 Payment Details: /paymentdetails

After making your selection, hit Send and watch the magic happen! 🚀

Be Curious About the Response

Take a closer look at the fields in each API response 🧐. These fields represent the data being fetched, and each one has a purpose. Here’s how to make the most of this exploration:

  • Ask Questions: Think about each field. Why is this field important? What role does it play in the overall data structure?
  • 🛠️ Plan Your Tests: How would you test each field? For example, is the driver’s name spelled correctly? Is the policy start date valid?
  • Validate the Data: Check if the data in each field makes sense. For instance, are payment amounts accurate, or are vehicle registration numbers formatted correctly?

Why This Matters

This exercise isn’t just about fetching data—it’s about understanding it. By questioning each field, you’ll start to think like a tester and uncover hidden insights. The more curious you are, the better prepared you’ll be to ensure the quality of APIs in real-world scenarios.

What’s Next?

Once you’ve explored the fields and responses, jot down your observations and ideas for testing. In the upcoming sections, we’ll dive into structured approaches to test these APIs effectively and ensure they meet expectations. Let’s keep the momentum going! 💡

Step 3: API Components

How APIs Work in Auto Insurance

APIs (Application Programming Interfaces) are like helpful assistants in an auto insurance company 🚗. Imagine you’re an app that needs information about a driver, their insurance policy, or their car. Instead of digging through a big file cabinet 📂, you ask the API to fetch what you need—it’s like having your personal helper 🤖!

How It Works

  • 📌 Endpoints: Think of these as specific desks in an office. For example:
    • 👤 /drivers for driver details
    • 📄 /policies for policy information
    • 🚘 /vehicles for vehicle data
  • 🛠️ Requests: You tell the API what you need, like asking for a driver’s details, vehicle info, or a policy update.
  • 📬 Responses: The API brings back the requested data, such as a driver’s name, their car’s registration number, or the type of insurance coverage.

Actions You Can Take (Methods)

  • 🔍 GET: Like asking, “Can you show me this driver’s details?” The API fetches and delivers the information.
  • ✍️ POST: When adding a new car to a policy, you send its make, model, and registration number to the API.
  • 📝 PUT: If a policyholder updates their coverage, you ask the API to modify the policy details.
  • DELETE: If a car is no longer insured, you tell the API to remove it from the records.

How the API Responds

  • 200 (OK): Everything worked perfectly, and here’s the requested data!
  • 🎉 201 (Created): A new driver, car, or policy was successfully added.
  • ⚠️ 400 (Bad Request): The API couldn’t understand your request because some details were missing or incorrect.
  • 🔍 404 (Not Found): The driver or policy you’re looking for doesn’t exist.
  • 🚨 500 (Server Error): Something went wrong on the server, and the API couldn’t complete your request.

Questions for You

To get you thinking like a tester 🧠, here are some questions:

  • What request type (method) did you use for token generation?
  • What request type (method) did you use for the Driver API request?
  • What was the status code for both requests?

Example of a 200 Success Status Code

When you send a successful request, you’ll see a status code like this:

Experimenting with API Requests

Let’s get hands-on and explore how small changes in your API request can lead to different results. This is a great way to understand how APIs handle errors and validate requests 🚀.

Try These Experiments

  • 🔗 Remove "rest" from the URL: Update the URL by removing the word rest and hit Send.

    Question: What status code did you get? 🤔 This helps you understand how the server reacts to incorrect or incomplete endpoints.

  • 🔒 Remove the Token: Fix the URL by adding back "rest" and remove the Authorization header from your request and hit Send again.

    Question: What status code did you get this time? This tests the server’s authentication mechanisms and shows how it handles unauthorized requests.

What Do These Experiments Teach You?

APIs are like strict gatekeepers 🛡️. They ensure that every request meets specific rules before granting access. By experimenting, you’re learning:

  • How endpoints are validated: Incorrect URLs often lead to errors like 404 (Not Found).
  • The importance of authentication: Missing or invalid tokens result in errors like 401 (Unauthorized).
  • How to debug API errors: Each status code provides a clue about what went wrong and how to fix it.

More About API Components (Must Read)

Before moving forward, check out the attached document 📄. It covers:

  • 📌 Endpoints: Learn how APIs organize different types of data access points.
  • 🔑 Authentication: Understand how tokens and headers secure API communication.
  • 📊 Responses: Dive into how APIs structure the data they send back.

Understanding these components is critical for becoming an expert in API testing. So, don’t skip it! 😊

Step 4: GET APIs

What Are GET APIs in Real Life?

Imagine you’re at a library 📚. You walk up to the librarian and say, “Can you find me a book about space exploration?” The librarian doesn’t add new books to the shelves or change anything; they simply locate the book you want and hand it to you. That’s how a GET API works in real life—it fetches data without making any changes.

GET APIs are like the librarian, always ready to retrieve information for you. Whether you’re searching for a weather update ☀️, a friend's social media profile 👤, or a movie title 🎬, GET APIs fetch what you need and deliver it. You don’t change the information—it stays safe on the server, but you get a copy to use.

GET APIs in an Auto Insurance Company

In an auto insurance company 🚗, GET APIs work as your information retrievers. For instance:

  • 🧑‍💼 Driver GET API: Fetches details about a specific driver, like their name, license number, and contact information.
  • 🚘 Vehicle GET API: Retrieves data about a vehicle, such as its make, model, registration number, and usage history.
  • 📄 Policy GET API: Fetches information about an insurance policy, including coverage type, premium amount, and validity dates.

These GET APIs ensure that different systems in the company can access the necessary information quickly without altering the original data. For example, a customer support agent might use a GET API to pull up a driver's policy details while answering a query.

Policy GET API
Driver GET API

In essence, GET APIs in an auto insurance company act like organized, reliable assistants 🛡️, providing access to the right information without making any changes to the database. They’re efficient, safe, and vital for smooth operations! 💼✨

Exercise: Analyze below document and answer below questions

Driver API

Base URL: https://generalinsurance-ff4b.restdb.io/rest/driver

  • What query parameter would you use to fetch a driver with the last name "Nolan"?
  • How would you modify the query to fetch only the driver with a specific object ID?
  • Experiment with searching for a driver whose first name is "Nolan." What query structure do you use?

Policy API

Base URL: https://generalinsurance-ff4b.restdb.io/rest/policy

  • How would you fetch a specific policy using its object ID?
  • Write a query to fetch all policies where the policy type is "Comprehensive."
  • Can you use multiple query parameters to filter policies by both status and date of issue?

Vehicle API

Base URL: https://generalinsurance-ff4b.restdb.io/rest/vehicle

  • Use a query parameter to fetch vehicles with the make "Toyota" and trim "Premium."
  • How do you fetch details of a vehicle using its object ID?
  • Can you search for vehicles manufactured in a specific year, e.g., "2022"?

Challenge Section (Optional)

  • Combine multiple query parameters to find:
    • A driver whose last name is "Smith" and who lives in "New York."
    • Policies issued in the last 30 days and marked as "Active."
    • Vehicles with the make "Honda," trim "Standard," and year "2021."

Step 5: Automation Setup

Before learning about POST, PATCH and DELETE endpoints, let's do some Automation setup

How to Store a Token and Use It in Postman

  1. Create Environment in Postman
  2. Select DEV Environment in Postman that we just created.
  3. Enter below code into Post response under Scripts tab

    let response = pm.response.json();
    pm.environment.set("authToken", response.access_token);
    Code Explaination

    This code is used in Postman to automate storing a token from an API response. The first line, let response = pm.response.json();, takes the API response and parses it into a JSON object so it can be easily accessed. The second line, pm.environment.set("authToken", response.access_token);, extracts the access_token value from the response and saves it as an environment variable called authToken. This allows you to reuse the token in other API requests without manually copying and pasting it.

  4. Hit Send and verify the variable value

      Token should be stored into the authToken variable
  5. Reuse the variable
    • Use the variable inside the Get Driver API by using {{authToken}}
    • What we did is we created a variable and stored token value inside. Now if token expires, we don't need to copy and paste token. Just hit the token api and it should automatically reflect the updated token inside Get Driver API.

      Watch below video for complete tutorial

      We can create a variable such as URL and manually store the value and than reuse the URL in other requests. Watch this video for URL variable. In our project we will create many variable and reuse them.

Before moving to the next section please read following documents.