API Testing Primer: An Introduction

Functional testing will constitute the bulk of the testing performed during API testing. Functional testing includes testing each major function of the API including the create, read, update, and delete functions, commonly referred to as CRUD functions. These functions will also be tested against the data caching policies that are employed to be certain the cache hit, cache miss, and data change cases are correctly handled.

During functional testing it can be useful to approach the API under test as if it were a UI application. With a UI application, each interface control will be tested along with each control value. Think of a UI dropdown control having 5 different options that the user can select from, and that selecting each option results in a different operation being initiated on the UI application. This can be synonymous with a API parameter having an enumerated list of 5 options, each of which initiates the processing of different business rules that are reflected in the API response. Just as with the UI application, we must test each of the 5 parameter options during our API test.

Some of the functional API testing activities include:

• Parameter testing
  
  • Testing each request parameter and parameter value. For instance if a parameter supports an enumerated list of values then each values will be tested.
• Response testing
  
  • Similar to the request parameter testing, each response field will be tested including verifying that each request value is included in the response.
• Data Validation
  
  • During this testing we check to verify that the data that is returned in a response is correct. This may include comparing the API response data with the source data such as the database that the data is sourced from. The objective of this verification is to confirm that the data in the database and the application of any business rules produces the same data that is in the API response.
• Error Handling
  
  • Error handling testing involves sending invalid requests to the API to verify that it properly handles the requests. The types of invalid requests may include unauthorized, improperly formatted, improperly encoded, or requests that violate business rules.
• Boundary Testing
  
  • Boundary testing is testing to verify that parameter values near or over a limit are properly handled by the API. For instance if an API parameter takes a value of 0 – 100 we will test that the correct response is provided when value ‘0’ and ‘100’ are sent. If an API accepts a CSV file as input with a limit of 50,000 records then we test with a CSV file with 50,000 records in it. We also test response fields with regard to boundary testing; verifying that given response field will return values at the minimum and maximum scopes.
• Cache Policy Testing
  
  • Cache testing may or may not be required depending on if the API is caching any API responses on the server. An API may cache responses to increase performance and reduce the load on the database. API responses that retrieve data that does not frequently change are good candidates for caching. Testing involves making a request to an API (HTTP GET method) that caches the response and then repeating the request to verify that the data is cached and retrieved from the cache correctly. Further testing would involve updating or deleting the data that is served in the response and then making the GET request again to verify that the API serves the updated data or does not respond with the record if it was deleted.
• Performance Testing
  
  • During functional testing we will get our first look at performance and load testing. Together with the product owners and development team a standard response time will need to be defined. Then during functional testing we will evaluate the API calls with different parameter values, responses, and business rules to verify that the API meets the response time requirements. The APIs must meet their performance requirements as a prerequisite for load testing to be performed.

These are just a few of the functional testing activities than can be performed. We will explore each of these in more depth, as well as some others, in a future blog post.

Load testing involves executing multiple simultaneous API requests to simulate usage by multiple users of a client application that is using the API. The objective of this testing is to discover if the API can serve multiple simultaneous requests and still remain performant and not suffer any functional degradation. This testing is also used to test any automated scaling policies put in place on the server to increase the number of API application instances when traffic increases during peak usage.