Blog

What Is API Testing?

by admin | Dec 7, 2020 | API Testing, Fixed, Blog | 0 comments

Once individuals understand and profoundly comprehend API testing, they, in a significant endeavor, can unlock the power to formulate an effective testing strategy. In software development, an Application Program Interface (API) is a communication method in which various applications correspond with each other using a common language. It is often referred to as a contract. Examples of API include swagger for RESTful services, WSDL for SOAP services, and interface language in databases, i.e., SQL. API works similar to UI. Much like how UI allows users to communicate with an application, APIs enable machines to interact with each other efficiently.

What is API testing?

API testing is undertaken by testers and developers to gauge the reliability of the software. In the absence of API testing, developers will be stuck with manual testing programs, waiting until the entire application is stacked with a functional UI to begin their assessment. In this article, we have further explained how to write manual test cases for API testing.

How can you undertake API testing?

The best way to approach an API is to start from the bottom and work your way to the top, and to this end, a fantastic way to formulate a test strategy is to refer to Martin Fowler’s testing pyramid. The pyramid approach facilitates individuals to undertake an array of API tests (for example, contact, scenario, performance, etc.) with a comprehensive understanding to assume unit tests followed by UI tests. API tests allow developers to examine an application logically at a level that unit tests cannot provide.

Contract Tests

The most primary API test is the contract test, which assesses the condition of the contract itself. The contract illustrates how to interact with the interface, services available, and how a user can activate them. It serves as a communication channel, and if there is a flaw in the contract, nothing else in the application matters otherwise. Contract tests validate the legitimacy of the code and work a series of tests that can authorize that:

• The service contract is formulated as per the specifications
• Semantic correction (schema validation) of message request and response
• Tests the validity of the endpoint (HTTP, MQ/JMS Topic/Queue, etc.)
• Ascertains whether the contract has undergone any alterations upon running

Component Tests

Component tests can be categorized as unit tests for the API. Similar to unit tests, component tests too pick individual cases and check them under isolated settings. You can formulate component tests by creating a test step for each method or resource that is available in the service contract list. The most convenient mode to do is to consume the list and let the service contract establish clients.

You can then data-validate each individual test case with positive and negative outcomes to authenticate that the responses that are obtained as results have the following characteristics:

• Ensure that the request payload is constructed comprehensively (schema validation)
• Verify that the response payload is well-built (schema validation)
• The response status turns out to be as anticipated (200 OK, SQL result set returned, or even an error if that’s what you are looking for)
• The response error payloads involve correct error messages
• The service responds within an appropriate timeframe.
• Individuals must ascertain that the response obtained must match the expected baseline. It can take two forms:

Regression/diff- The process is a fantastic catalyst in identifying API change. During this procedure, the payload response looks precisely the same as you jump from call to call. It is also referred to as the top-down approach, where all you need to is take a snapshot of the response and verify it accordingly.

Assertion- The distinctive elements in the response status match your expectations (it is a surgical, more tightened approach that is targeted at finding a specific value in the output process)

The individual tests are essential assessment criteria since subsequent leveraging of the verification will be based upon it. What is the need to build individual test cases when you refer to API test calls at any time? It not only promotes consistency and efficiency but also simplifies the process to approach API.

Scenario Checks

Scenario testing attributes to the conditions one can concoct in their heads while they are API testing. In this testing strategy, you can assemble distinctive components and make them undergo a sequence of tests. Moreover, there are two comprehensive techniques for obtaining an immaculate series:

• Evaluate the user story to know the individual API calls that are system is making.
• Test the UI and apprehend the traffic being made to the underlying APIs.

Scenario tests allow individuals to understand if flaws might be induced by combining various data points together. An enormous benefit of scenario testing is the ability to authenticate expected behavior when your APIs are utilized in a manner that you did not expect.

When you carry forward a release on an API, you provide a series of building blocks to the world. You may have laid down the techniques for amalgamating these blocks together, but sometimes clients have unrealistic desires. However, in a vague attempt to achieve those standards, they can unexpectedly combine APIs that can expose your application to potential defects. Consequently, to safeguard your work against this, you may want to formulate n number of scenario tests with different combinations and sets of APIs to bulletproof your application against critical breakdown or potential flaws.

Conclusion

Formulating an automated API testing strategy is by far the best way to secure your application from potential malfunctioning or abrupt collapse. API testing can allow you to build a framework to identify threats and flaws in every layer. It would further make your application more transparent to your clients.

API Automation Testing using Apiritif Framework

by admin | Sep 7, 2019 | API Testing, Fixed, Blog | 0 comments

Writing automated API tests can be done using any Python HTTP client library & assertions packages. If we get all the API testing capabilities in one framework, it would minimize script creation & maintenance time. In this article, you will learn how to automate API testing using Apiritif framework.

Apiritif is a Python based API testing framework which eases automated API tests creation and maintenance. It is developed by Blazemeter and has all necessary utilities and assertions methods for API testing.

HTTP Requests

from apiritif import http

response = http.get("http://example.com")
response.assert_ok()  # will raise AssertionError if request wasn't successful

Assertions

response = http.get("http://example.com/")

# assert that request succeeded (status code is 2xx or 3xx)
response.assert_ok()
# assert that request has failed
response.assert_failed()

# status code based assertions
response.assert_2xx()
response.assert_3xx()
response.assert_4xx()
response.assert_5xx()
response.assert_status_code(code)
response.assert_not_status_code(code)

# content-based assertions

# assert that response body contains a string
response.assert_in_body(member)

# assert that response body doesn't contain a string
response.assert_not_in_body(member)

# search (or match) response body with a regex
response.assert_regex_in_body(regex, match=False)
response.assert_regex_not_in_body(regex, match=False)

# assert that response has header
response.assert_has_header(header)

# assert that response has header with given value
response.assert_header_value(header, value)

# assert that response's headers contains a string
response.assert_in_headers(member)
response.assert_not_in_headers(member)

# search (or match) response body with a regex
response.assert_regex_in_headers(member)
response.assert_regex_not_in_headers(member)

# assert that response body matches JSONPath query
response.assert_jsonpath(jsonpath_query, expected_value=None)
response.assert_not_jsonpath(jsonpath_query)

# assert that response body matches XPath query
response.assert_xpath(xpath_query, parser_type='html', validate=False)
response.assert_not_xpath(xpath_query, parser_type='html', validate=False)