REST API Testing and Manual Test Cases

REST is a set of architectural styles that acts as an interface between physically separate components across the internet. In simple language, one can say that this allows the requesting system to access web resources by using a uniform and predefined set of rules.  It is built on a client-server paradigm, with stateless and suitable communication. It is not a protocol or a standard, but a set of architectural constraints. The article focuses on discussing REST API testing and manual test cases.

The following topics will be discussed here:

1. What is REST API?
2. REST API Testing
3. Different ways of testing REST API
4. Procedure for REST API Testing
5. Steps to test RESTful API
6. Authenticating the results
7. Challenges in API Testing
8. Tools for REST API Test

Let’s discuss each of these topics in detail.

What is REST API?

API is an Application Programming Interface, a set of rules and regulations that describes how applications connect and communicate with each other. This is done by requesting information from the server and then receiving a response. A REST API is an API that conforms to the concept of modeling and accessing an application’s data(web services) simply and flexibly.

Suppose a client has made the request by REST API(which is an Application Programming Interface). The REST API transfers a representation of the resource’s state to the endpoint (in JSON, HTML, XLT, Python, PHP, or Plain Text format). REST APIs have several  HTTP methods which have request headers and response headers informing about the connection status and status code.

REST API Testing

REST API Testing is a technique that is done by recording the response of the REST APIs by sending various HTTP requests to check the validity and working of the APIs for web applications. Instead of standard user input(like keyboards and output), we use software to send calls, obtain output and record the response. Automation testing of API needs an app that can interact through an API.

A REST API acts as a contract between the client and the server(the client by making a request from the server for the response). So, before moving forward, our first duty should be checking the contract by inspecting the service. There should be no duplicate, and missing functionality and endpoints should be correctly named. Our first concern should be about the functionality of the API(whether it is working properly or not(without bugs)).  

For testing to be done, our application must interact with the sample API. API testing requires two things:

• A tool or a framework to operate the API such as Advanced REST Client, Postman REST Client, or Curl in Linux.
• A tester writes the code to test the sample REST API.

Different Ways of Testing REST APIs

1. Validation Testing: It is considered as the assurance of the correct development and occurs at the final steps verifying the behavior and efficiency aspects of the product.
2. Security Testing: This is done to secure the API implementation from external threats. It also includes the design of the API access control, validation of encryption methodologies, and user rights management.
3. UI Testing: It focuses on the user interface for the API rather than testing the API itself.
4. Functional Testing: Particular functions in the codebase are included in the Functional Testing and handle the API Function in a planned manner.
5. Load Testing: It monitors whether the solution provided is working as planned or not and generally occurs after the whole codebase is completed.
6. Runtime and Error Detection: It mainly focuses on error detection, execution error, and monitoring and deals with the universal result of the API Codebase(as it is related to the actual running of the API).
7. Penetration Testing: It is involved in the auditing process as a second test.

Steps for Testing REST API

Below are the steps for testing REST API:

Step 1: The very first step of the API Testing procedure is setting up and using a testing Environment, which will be further useful in the API Testing process in product development.

Step 2: For the above procedure, we need to open up any tool(like Postman, REST-assured, swagger, etc) or framework and set up the necessary parameters of the API.

Step 3: We can use the tools Online(in Google Chrome) or by downloading, installing, and launching them.

Step 4: The testing environment includes configuring the server and database based on the requirements of the application.

Step 5: Now, we need to enter the API URL which we want to test in the textbox.

 

Step 6: The further procedure needs to select the HTTP(Hypertext Transfer Protocol) method(For example, POST, GET, PUT, DELETE), it is the type of the API whose URL we have entered(POST for creating, PUT for updating, DELETE for deleting).

 

Step 7: Now after providing the HTTP Methods, in the Headers textbox, give the headers set that you want to provide(For example, Authorization in the Postman tool).

 

Step 8: We can provide parameters(query parameters for filtering) in the tool if it is defined in the code.

 

Step 9: Now, switch to the Body section and provide the Body content to it. 

Step 10: Firstly, set the required body content type – application/JSON/text. Add the editor view type(e.g. Raw Input). Pass the request body of the API in the payload. For example: If it is POST API, pass the body or parameter under the payload:  {“key1”:”value1”, “key2”:”value2”}.

 

Step 11: Now invoke an API call by clicking the send button.

 

Step 12: Now authenticate the result by clicking the details to view the response details. 

 

Authenticating the Results

Now the question arises, how to analyze and authenticate the results? For that, we have to understand some API actions i.e. correct HTTP status code. Those are:

Challenges in API Testing

1. Initial Setup of API Testing: Maintaining API Testing preparation and launch of its environment requires certain technical skills from the team which is one of the most challenging parts of the process. It is not because it is difficult, but because it can be a substantial motivation killer. During this stage, problems will occur frequently and in large amounts. What we need is that motivate the dedicated software testing team through the process (as it pays off over the long term). 
2. Maintaining Data Formatting(updating schema of the API Testing): Schema acts as a blueprint for describing the API syntax and grammar of the text. It specifies how data is formatted in the code and handles all the requests and responses and contains the format of the data. It is necessary to maintain this throughout the process. Although it is a challenge, we can overcome this. It is done by maintaining and updating the schema regularly to ensure that the newly added parameters are included in the schema.
3. Sequencing the API calls: When working on multi-threaded apps, the user may send multiple API requests at the same time, which can become a sequencing challenge for the testing team if not sent in the correct order. To overcome this problem, the API calls should be in the correct order so that the program will throw an error. An example of this challenge, requesting a DELETE or GET kind of API before POST(calling an API about the user’s profile, before creating it), which would throw an error.
4. Validating Parameters: Requesting the API requests, the Testing team may find validating the parameters challenging as well. A large number of parameters and their use cases make it an unsettling task. We need to be sure that every crucial parameter data uses the correct string or numerical data type, which fits within an assigned value range, length limitation, and validation criterion. This challenge can be overcome by continuous synthetic API monitoring to hold upon the issues as early as possible.
5. Testing All Possible Parameter Request Combination: The communication between the systems(handled by API) is done by assigning data values to the parameters and passing those parameters through data requests. Here, it’s necessary and a challenge to test all the parameter request combinations in the API to test for flaws in specific configurations. Otherwise, a project may end up having two values for the same parameter. So, try to add fewer extra parameters to reduce the chance of likely combinations. Also, there should be the correct choice of applications that are not complex for everyday operations.
6. Leaving Out Response Time Assertions: APIs generally took lesser time when called upon. But what when it took more than 10 sec, will it be efficient? Not at all! and becomes more challenging for software testers. So, set up response time assertions that should be reasonable and would be able to depict the response time.  A large threshold response time assertion is much much better than nothing mainly when testing production endpoints.
7. Tracking System Integration: Always ensuring that the API system is working correctly with the data tracking system or not is also a big challenge. So, we need to bring back the correct responses on whether a call is working properly. As this is the last step of the Testing process, the team may be too frustrated that they don’t give it the proper attention it needs. To overcome this problem, one needs to focus on the designing part. Also, check out its integration with the other systems. Do not test the apps in parallel with the Critical Integration System.

Top Tools for REST API Test

1. Postman:  Postman is a plugin in Google Chrome. This tool is best for API Testing. Its services have been expanded to Windows and Mac. Its API Development Environment has been divided into three parts Collections, Workspaces, and Built-in Tools which is helpful in running requests, debugging the code, creating automated test, etc.

Features:

• It is easy to set up parameters on method calls.
• It is helpful in Automation Testing.
• All the modern web API data can be extracted using postman.
• It has the ability to store commands.
• It has the feature to create a collection of REST calls and save it.
• It offers a rich interface.

2. REST-assured: REST-assured is best for Automation Testing rather than manual testing. It has been considered one of the best API Testing tools help in JAVA. Writing code in JAVA involves a lot of ceremonies but REST-assured handles help to write it in a clear and descriptive manner which results in responsive code.

Features:

• It provides several authentication mechanisms(like  POST, GET, PUT, DELETE, OPTIONS, PATCH, and HEAD requests).
• To test using REST-assured, Testers need not have extreme knowledge of HTTP.
• It has some built-in functions which do not require coding things from scratch.
• It also allows using the syntax of BBD/ Given/When/Then syntax.

3. Swagger: Swagger is one of the best tools for designing and documenting REST APIs. It is a set of open-source tools, whose origination is based upon OpenAPI specification. These API specifications can be written YAML or JSON. The major Swagger tool includes:

• Swagger Editor.
• Swagger UI.
• Swagger Codegen.
• Swagger Editor Next (beta).
• Swagger Core.
• Swagger Parser.
• Swagger APIDom.

Features:

• It offers fast and standardized API Design.
• It facilitates and coordinates the entire API lifecycle from a central internal repository.
• It offers secure API collaboration.
• It helps in generating beautiful documentation, that is interactive, fully hosted, and privacy enabled.

4. Karate DSL: Karate DSL is a famous open-source framework running on JAVA. It is used for Automation Testing, Performance Testing, and Load Testing, and is based on the cucumber library. It helps in API-based BBD tests in a simple way. It has its own specific language-DSL(Domain Specific Language).

Features:

• It supports multi-thread parallel execution(it’s very fast).
• It offers an easy-to-write test(for those who are not into core programming).
• It allows(support) both XML as well as JSON.
• It has very powerful assertions and JSON schema validation.
• It also supports configuration switching.
• In this, we can reuse payload data for API testing. 

5. Katalon: Katalon is one of the popular, robust and comprehensive test Automation tools (for API, Web, desktop testing, and mobile testing). This platform brings a struggle-free testing environment for the testers with or without programming knowledge. This provides easy deployment. Deployment is done by including all frameworks, ALM integrations, and plugins in one package.

Features:

• The Katalon platform supports the data-driven approach.
• It supports all types of REST, SOAP requests, and SSL client certificates.
• It can be used for both automated and exploratory testing.
• It easily imports tests from swagger(2.0 &3.0), Postman, WSDL, and WADL.
• It is suitable for both beginners and experts with manual and scripting modes.
• Katalon has pre-built and customizable code templates.
• It provides auto-completion, auto-formatting, and code inspection for the code.