1

I'm writing up some postman tests for a REST API:

api/controller/getPerson?person=personID

I'm curious as to what types of things would come in your head for testing this? the call itself requires one paramater which is an int. So far I've added

  • Valid person, each key pair in the JSON response
  • Response codes/Response times are accurate & respectable
  • Negative ID
  • ID greater than max int
  • Symbols ID
  • String ID
  • Empty ID
  • ID 0
  • Double/decimal ID
  • Response is returned in JSON

I'm looking to make a good quality set of tests to cover as much as possible and learn a thing or two at the same time, so what comes to mind for you when faced with a basic call like this?

Example Response would be:

   {
  "Balance": -1,
  "RoomNumber": "900",
  "DateOfBirth": 504939600000,
  "Deleted": false,
  "Forename": "Simon",
  "PersonNumber": "",
  "Address": "",
  "LanguageID": 2,
  "Password": "pa$$",
  "PeopleID": 60000,
  "Surname": "API",
  "Balance2": -1
    }
2

Looks like you've got some of the input checks.

Some thoughts:

  • You mention Postman, so I'm guessing no DB access?
  • The API returns the plaintext password? That seems bonkers
  • beyond the input checks you've listed, I might try an ID I know that exists vs. an ID I know doesn't exist
  • some response checks beyond just a JSON validation would make sense
    • is the DateOfBirth reasonable? Looks like a linux epoch time in ms?
    • are the LanguageID values valid? Guessing that's an ENUM on the server/DB side, so you should be able to figure out what valid values are. Same thing with the RoomNumber.
    • Unclear if Balance and Balance2 should be linked or can be cross-checked?
    • Verify that Deleted is a boolean

If you do have DB access, cross checking the API results vs. a SQL query would make a lot of sense.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.