Before going to API Testing, let’s first understand
What is API Testing?
- API is an acronym for Application Programming Interface.
- It enables communication and data exchange between two separate software systems. A software system implementing an API contains functions/sub-routines which can be executed by another software system.
What Does API Mean?
API Testing is entirely different from GUI Testing and mainly concentrates on the business logic layer of the software architecture. This testing won‘t concentrate on the look and feel of an application.
Check Also: Risk Analysis Software Testing
Instead of using standard user inputs (keyboard) and outputs, in API Testing, you use software to send calls to the API, get output, and note down the system’s response.
API Testing requires an application to interact with API. To test an API, you will need to
- Use the Testing Tool to drive the API
- Write your code to test the API
Setup of API Testing environment:
- API Testing is different than other testing types, as GUI is not available. Yet, you are required to initial setup environment that invokes API with a required set of parameters and then finally examines the test result.
- Hence, Setting up a testing environment for API testing seems a little complex.
- The database and server should be configured as per the application requirements.
- Once the installation is done, the API Function should be called to check whether that API is working.
Types of Output of an API Output of API could be:
- Any data
- Status (say Pass or Fail)
- Call another API function.
Let’s look at an example of each of the above Types
Example: There is an API function that should add two integer numbers.
Long add(int a, int b)
The numbers have to give as input parameters. The output should be a summation of two integer numbers. This output needs to verify with the expected outcome. Calling needs to be done such as
add (1234, 5656)
Exceptions have to handled if the number is exceeding the integer limit.
Status (say Pass or Fail): Consider the below API function
They return any value such as True (in case of success) or false (In case of error) as an output. A more accurate Test Case would be, can call the functions in any of the scripts and later check for changes either in the database or the Application GUI.
Calling of another API / Event: In this case, we call one of the API functions, which in turn will call another function.
For example – the First API function can be used for deleting a specified record in the table, and this function, in turn, calls another function to REFRESH the database.
Test Cases for API Testing: Test cases of API testing based on
- Return value based on input condition: It is relatively easy to test, as input can be defined and results can be authenticated
- Does not return anything: When there is no return value, the behavior of API on the system to be checked
- Trigger some other API/event/interrupt: If the output of an API triggers some event or interrupt, then those events and interrupt listeners should be tracked
- Update data structure: Updating data structure will have some outcome or effect on the system, and that should be authenticated
- Modify certain resources: If API call modifies some resources then it should be validated by accessing respective resources
The approach of API Testing: Following points helps the user to do the API Testing approach:
- Understanding the functionality of the API program and clearly define the scope of the program
- Apply testing techniques such as equivalence classes, boundary value analysis, and error guessing and write test cases for the API
- Input Parameters for the API need to planned and defined appropriately
- Execute the test cases and compare expected and actual results.
What to test for in API Testing: API testing should cover at least following testing methods apart from usual SDLC process
- Discovery testing: The test group should manually execute the set of calls documented in the API like verifying that a specific resource exposed by the API can be listed, created and deleted as appropriate
- Usability testing: This testing verifies whether the API is functional and user-friendly. And does API integrates well with another platform as well
- Security testing: This testing includes what type of authentication is required and whether sensitive data encrypted over HTTP or both
- Automated testing: API testing should culminate in the creation of a set of scripts or a tool that can be used to execute the API regularly
- Documentation: The test team has to make sure that the documentation is adequate and provides enough information to interact with the API. Documentation should be a part of the final deliverable
Best Practices for API Testing:
Read Also: Different Agile (Scrum) Practices
- Test cases should be grouped by test category
- On top of each test, you should include the declarations of the APIs called.
- Parameters selection should explicitly mention in the test case itself
- Prioritize API function calls so that it will be easy for testers to test
- Each test case should be as self-contained and independent from dependencies as possible
- Avoid “test chaining” in your development
- Special care must be taken while handling one-time call functions like – Delete, CloseWindow, etc.
- Call sequencing should be performed and well planned
- To ensure complete test coverage, create test cases for all possible input combinations of the API.
Types of Bugs that API Testing detects:
- Fails to handle error conditions gracefully
- Unused flags
- Missing or duplicate functionality
- Reliability Issues. Difficulty in connecting and getting a response from API.
- Security Issues
- Multi-threading issues
- Performance Issues. API response time is very high.
- Improper errors/warning to the caller
- Incorrect handling of valid argument values
- Response Data is not structured correctly (JSON or XML)
Tools for API testing: Since API and Unit Testing, both target source code, similar tools can use for testing both.
- SOAPUI – It’s an easy-to-use tool with extensive REST and SOAP API testing capabilities – no scripting experience is required.
- Postman with jetpacks
- Postman with Newman
- Eclipse SDK tool- Automated API testing
Challenges of API Testing: Challenges of API testing includes:
- Main challenges in API testing is Parameter Combination, Parameter Selection, and Call Sequencing
- There is no GUI available to test the application which makes difficult to give input values
- Validating and Verifying the output in a different system is a little difficult for testers
- Parameters selection and categorization is required to be known to the testers
- Exception handling function needs to test Coding knowledge is necessary for testers
API consists of a set of classes/ functions/procedures which represent the business logic layer. If API is not tested properly, it may cause problems not only in the API application but also in the calling application.