Cheat sheet
API testing
Status codes, what to assert, auth, and the cases beyond the happy path.
Status codes to know
- 200 / 201 / 204
- OK, created, no content.
- 400 / 422
- Malformed request vs well-formed but invalid data.
- 401 / 403
- Not authenticated vs authenticated but not allowed.
- 404 / 409 / 429
- Not found, conflict (duplicate or version clash), too many requests.
- 500 / 502 / 503 / 504
- Server error, bad gateway, unavailable, gateway timeout.
What to assert
- Status and headers
- Code, content-type, caching and security headers.
- Body
- Schema, required fields, types, values, and no leaked internal fields.
- Side effects
- Database row, event published, email queued.
- Performance
- Response time against a budget, using percentiles over many calls.
Beyond the happy path
- Idempotency
- Repeating PUT or DELETE gives the same state; POST needs an idempotency key to be safe.
- Auth and permissions
- No token, expired, wrong scope, another user's resource id.
- Input abuse
- Empty, huge, wrong type, injection strings, unicode.
- Concurrency
- Two writers on one record; check the version or lock handling.
REST Assured shape
- Given-when-then
- Arrange the request, act, assert the response.
given().auth().oauth2(token).when().get("/orders/1").then().statusCode(200).body("id", equalTo(1));