This is one of the most common needs today and subsequently a common interview question.

This question is intended to be a canonical answer to the general question of "How do I test an API". Other questions in this vein are more specific. For this question I am going high-level as indicated by the short question title.

  • Do you mean remote API? Or API of a class, of a library? – dzieciou Jul 18 '19 at 18:33

API Test Checklist

  • API Endpoints
  • Status Codes
  • Payload Data
  • Performance
  • Security


  • What documentation exists ?
  • What functionality it provide ?
  • Does it support concurrency ?
  • What are the API endpoints ?
  • Is the API internal or external ?
  • Which endpoints are idempotent ?
  • Are endpoints stateless or stateful ?
  • Do any workflows1 vary by client ?
  • Are there performance requirements ?
  • Do API endpoints make up a workflow ?
  • What validations are expected for data ?
  • What system or library is behind the API ?
  • Do we need to mock dependent services ?
  • Does it constrain traffic aka Rate Limiting ?
  • What (if any) versioning approach is used ?
  • Does the API support Multiple Languages ?
  • If already using SOAPui, how is it integrated ?
  • Is the API be restricted to a country or region ?
  • Does it provide client stubs in specific languages ?
  • What status codes are expected for given endpoints ?
  • Does the API use HATEOS2 for self documentation ?
  • What kind of data validation/ testing can be performed ?
  • What API is supported by the test framework I'm using ?
  • What actions are performed, e.g. GET, PUT, POST etc ?
  • Do we need to prepare dependent test data or services ?
  • What non-API approaches will be needed to verify data ?
  • What non-API approaches will be needed to prepare data ?
  • Are there existing API definitions e.g. WADL, WSDL, Thrift ?
  • What (if any) Authorization (‘what’) mechanism will be used ?
  • What (if any) Authentication (‘who’) mechanism will be used ?
  • Who will use it, external programmers or another internal module ?
  • What format(s): SOAP, REST, GraphQL, Thrift, ProtoBuffer, Other ?

1 Workflows often require multiple API calls and may have dependencies between them
2 HATEOS - Hypertext As The Engine Of Application State, which allows self-discovery of an API

  • 1
    A very interesting overview, and today one of the most important questions at all. But you wouldn't have to clarify which tools make a test possible via an API gateway. Let's take the example of WSO2 which has already integrated load and performance testing, penetration. – Mornon Jul 18 '19 at 12:14
  • 1
    Another point would be the direct integration of SoapUI into existing environments. – Mornon Jul 18 '19 at 12:15
  • 1
    Meta: Can one answer their own question? – João Farias Jul 18 '19 at 13:16
  • 1
    Does it constrain traffic aka Ratę Limiting? Does it provide client stubs in specific languages or IDL to generate such clients e.g. WADL, WSDL, Thrift definitions? – dzieciou Jul 18 '19 at 16:45
  • 2
    @JoãoFarias - One can absolutely answer their own question. It's most common for canonical questions/answer like this one, but can also happen when someone has a problem and later finds the answer and posts it for reference (like this question: sqa.stackexchange.com/questions/3645/…) – Kate Paulk Jul 19 '19 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.