Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
API testing
open-in-new
<h2 id="api-testing-overview">API testing overview</h2> <p>API testing involves testing APIs directly (in isolation) and as part of the end-to-end transactions exercised during integration testing.<a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a> Beyond <a href="/facts/Representational_state_transfer/Q58zfr5h">RESTful APIs</a>, these transactions include multiple types of endpoints such as <a href="/facts/Web_services/qxrwqB3D">web services</a>, <a href="/facts/Enterprise_service_bus/tl42uecL">ESBs</a>, <a href="/facts/Database/VYcpkevb">databases</a>, <a href="/facts/Mainframe_computer/nrBR6rWa">mainframes</a>, <a href="/facts/Web_application/BLkF3BIN">web UIs</a>, and <a href="/facts/Enterprise_resource_planning/IHhjWH4z">ERPs</a>. <a href="https://www.hypertest.co/api-testing/top-10-api-testing-tools">API testing</a> is performed on APIs that the development team produces as well as APIs that the team consumes within their application (including third-party APIs).<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> </p><p>API testing is used to determine whether APIs return the correct response (in the expected format) for a broad range of feasible requests, react properly to <a href="/facts/Edge_cases/E5po5oDy">edge cases</a> such as failures and unexpected/extreme inputs, deliver responses in an <a href="/facts/Service-level_agreement/lR2Gv0gv">acceptable amount of time</a>, and respond securely to potential <a href="/facts/Cyberwarfare/UYp25v4v">security attacks</a>.<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a><a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a> <a href="/facts/Service_virtualization/lTXDfSjr">Service virtualization</a> is used in conjunction with API testing to isolate the services under test as well as expand test environment access by simulating APIs/services that are not accessible for testing.<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a> </p><p>API testing commonly includes testing <a href="/facts/Representational_state_transfer/Q58zfr5h">REST</a> APIs or <a href="/facts/SOAP/vXlAMnjp">SOAP</a> <a href="/facts/Web_services/qxrwqB3D">web services</a> with <a href="/facts/JSON/bs1rUAhd">JSON</a> or <a href="/facts/XML/clNgUfWk">XML</a> <a href="/facts/Payload_(computing)/zN2Pgfq6">message payloads</a> being sent over <a href="/facts/HTTP/TWtvf7JD">HTTP</a>, <a href="/facts/HTTPS/MSWYz4zo">HTTPS</a>, <a href="/facts/Java_Message_Service/aTzyVj3n">JMS</a>, and <a href="/facts/IBM_WebSphere_MQ/LyfQzHIX">MQ</a>.<a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a><a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a> It can also include message formats such as <a href="/facts/Society_for_Worldwide_Interbank_Financial_Telecommunication/HTklm3zJ">SWIFT</a>, <a href="/facts/Financial_Information_eXchange/vjbv5nLm">FIX</a>, <a href="/facts/Electronic_data_interchange/ydnn0fTW">EDI</a> and similar fixed-length formats, <a href="/facts/Comma-separated_values/dv1pSR1r">CSV</a>, <a href="/facts/ISO_8583/YfFoko40">ISO 8583</a> and <a href="/facts/Protocol_Buffers/4Pj3zymo">Protocol Buffers</a> being sent over <a href="/facts/Communications_protocol/5uady7cB">transports/protocols</a> such as <a href="/facts/TCP/IP/KNkxtSpw">TCP/IP</a>, <a href="/facts/ISO_8583/YfFoko40">ISO 8583</a>, <a href="/facts/MQTT/JltGCjue">MQTT</a>, <a href="/facts/Financial_Information_eXchange/vjbv5nLm">FIX</a>, <a href="/facts/Java_remote_method_invocation/psHXkdWr">RMI</a>, <a href="/facts/SMTP/TeCRKDpJ">SMTP</a>, <a href="/facts/TIBCO_Rendezvous/kRaCe6zu">TIBCO Rendezvous</a>, and <a href="/facts/Financial_Information_eXchange/vjbv5nLm">FIX</a>.<a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a><a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a> </p> <h2 id="api-testing-gui-testing-and-test-automation">API testing, GUI testing, and test automation</h2> <p>API Testing is recognised as being more suitable for <a href="/facts/Automated_testing/UAVXbSTV">test automation</a> and <a href="/facts/Continuous_testing/Tlcjxb7X">continuous testing</a> (especially the automation used with <a href="/facts/Agile_software_development/LDaISBAW">Agile software development</a> and <a href="/facts/DevOps/yRg6dIBc">DevOps</a>) than GUI testing.<a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a><a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a> Reasons cited include: </p> <ul><li>System complexity: GUI tests can't sufficiently verify functional paths and back-end APIs/services associated with multitier architectures. APIs are considered the most stable interface to the system under test.</li> <li>Short release cycles with fast feedback loops: Agile and DevOps teams working with short iterations and fast feedback loops find that GUI tests require considerable rework to keep pace with frequent change. Tests at the API layer are less brittle and easier to maintain.</li></ul> <p>For these reasons, it is recommended that teams increase their level of API testing while decreasing their reliance on GUI testing. API testing is recommended for the vast majority of test automation efforts and as much edge testing as possible. GUI testing is then reserved for validating typical use cases at the system level, mobile testing, and usability testing.<a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a><a class="footnote-ref" id="fnref:17" href="#fn:17"><sup>17</sup></a><a class="footnote-ref" id="fnref:18" href="#fn:18"><sup>18</sup></a> </p> <h2 id="types-of-api-testing">Types of API testing</h2> <p>There are several types of tests that can be performed on APIs. Some of these include smoke testing, functional testing, security testing, penetration testing, and validation testing. </p> <ul><li><a href="/facts/Artificial_intelligence/lJGauQwX">Artificial intelligence</a> (AI) used in API testing improves the efficiency and accuracy of the testing process. It can automatically generate test cases, identify potential issues, and analyze test results through machine learning to identify patterns and anomalies.<a class="footnote-ref" id="fnref:19" href="#fn:19"><sup>19</sup></a></li> <li></li> <li><a href="/facts/Smoke_testing_(software)/kWJBtv3m">Smoke test</a> - This is a preliminary test that checks if the most crucial functions of an API are working correctly and identifies any major issues before further testing.</li> <li><a href="/facts/Functional_testing/2VudQTaz">Functional testing</a> - This type of testing validates a software system against its functional requirements by providing input and verifying the output. It mainly involves black box testing and is not concerned with the source code.</li> <li><a href="/facts/Black_box_testing/j2velRR9">Black box testing</a> - This is a type of testing where the tester interacts with the API without knowing its internal workings. The tester provides input and observes the output generated by the API to identify how it responds to expected and unexpected user actions.</li> <li><a href="/facts/Unit_testing/SYoGGS3T">Unit testing</a> - This tests the smallest parts of an application, called units, for proper operation. In API testing, this includes testing single endpoints with a single request.</li> <li><a href="/facts/Interoperability_testing/7WgqUbXU">Interoperability testing</a> - This test checks if an API can interact with other software components and systems without compatibility issues. This applies to SOAP APIs.</li> <li><a href="/facts/Reliability_testing/cd6AS5w3">Reliability testing</a> - This tests APIs to determine if they meet expectations for functionality, reliability, performance, and security. It aims to ensure that the API consistently performs as expected.</li> <li><a href="/facts/Software_verification_and_validation/9xY9BFSM">Validation testing</a> - This confirms the software matches business requirements and if API tests match expected results. It is closely related to User Acceptance Testing.</li> <li><a href="/facts/Runtime_error_detection/CPoBsSEI">Runtime error detection</a> - This evaluates the actual running of an API and focuses on monitoring, execution errors, resource leaks, and error detection. Detected errors are fixed to prevent runtime breakdowns.</li> <li><a href="/facts/Fuzzing/I1GK5kxr">Fuzzing</a> - This test transmits random, invalid or unexpected input to an API to find unknown bugs and defects. An API fuzzer generates test inputs and request sequences to the API and records the response to see if any bugs or security vulnerabilities are uncovered.</li> <li><a href="/facts/Load_test/fHRPN97k">Load test</a> - This type of testing simulates real-world workloads to see how a system or application performs. The goal is to find bottlenecks and determine the maximum number of users or transactions the system can handle.</li> <li><a href="/facts/Software_performance_testing/qtlCrHme">Performance testing</a> - This type of testing evaluates how an API performs under certain conditions to assess the API's ability to handle high loads and maintain high-performance levels. There are two main types of API performance testing: functional testing and load testing.</li> <li><a href="/facts/Security_Testing/gtEmKE5b">Security Testing</a> - This checks for vulnerabilities in APIs to find and fix security gaps. It involves mimicking hacker actions to find bugs and prevent attackers from accessing or disrupting the API or its data.</li> <li><a href="/facts/Penetration_Testing/Jd7lFd4z">Penetration Testing</a> - Ethical hacking is used to assess the security of an API design. An external pentester finds vulnerabilities in API integrations due to incorrect business logic or programming issues to identify security vulnerabilities that attackers could exploit.</li> <li><a href="https://docs.oracle.com/cd/E55956_01/doc.11123/external_user_guide/content/wsi_compliance.html">WS-* compliance testing</a> - This testing applies to SOAP APIs and ensures proper implementation of standards such as WS-Addressing, WS-Discovery, WS-Federation, WS-Policy, WS-Security, and WS-Trust.</li> <li><a href="/facts/Graphical_user_interface_testing/6GGdMIPb">Web UI testing</a> - Checks if the visual elements of a web application's user interface work correctly and are user-friendly. It is different from API testing, which tests the communication between software components.</li></ul> <h2 id="software">Software</h2> <table><tbody><tr><th>Name</th><th>Vendor</th></tr><tr><td>SoapSonar</td><td>Crosscheck Networks</td></tr><tr><td><a href="/facts/SoapUI/CYk1guVS">SoapUI</a></td><td><a href="/facts/SmartBear_Software/rlE78srr">SmartBear Software</a></td></tr><tr><td>Postman API Platform</td><td><a href="/facts/Postman_(software)/Ep13CdXI">Postman (software)</a></td></tr><tr><td><a href="/facts/SOAtest/KLMUAtKw">SOAtest</a></td><td><a href="/facts/Parasoft/4G6EIRkV">Parasoft</a></td></tr><tr><td><a href="/facts/Swagger_(software)/99Vb5xtE">Swagger</a></td><td><a href="/facts/SmartBear_Software/rlE78srr">SmartBear Software</a></td></tr><tr><td><a href="/facts/Katalon_Studio/zQEqaU2B">Katalon Studio</a></td><td>Katalon</td></tr><tr><td>vStellar</td><td>vStellar</td></tr><tr><td>Step CI</td><td>Step CI</td></tr><tr><td>Insomnia REST</td><td><a href="/facts/Kong_Inc./FsJbjcHc">Kong Inc.</a></td></tr></tbody></table> <h2 id="see-also">See also</h2> <ul><li><a href="/facts/Automated_testing/UAVXbSTV">Automated testing</a></li> <li><a href="/facts/Service_virtualization/lTXDfSjr">Service virtualization</a></li> <li><a href="/facts/Software_testing/VoXzG9Tb">Software testing</a></li> <li><a href="/facts/Web_API_security/1IUJuy6R">Web API security</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>Testing APIs protects applications and reputations, by Amy Reichert, SearchSoftwareQuality March 2015 <a href="http://searchsoftwarequality.techtarget.com/tip/Testing-APIs-protects-applications-and-reputations" target="_blank">http://searchsoftwarequality.techtarget.com/tip/Testing-APIs-protects-applications-and-reputations</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>All About API Testing: An Interview with Jonathan Cooper, by Cameron Philipp-Edmonds, Stickyminds August 19, 2014 <a href="http://www.stickyminds.com/interview/all-about-api-testing-interview-jonathan-cooper" target="_blank">http://www.stickyminds.com/interview/all-about-api-testing-interview-jonathan-cooper</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>The Forrester Wave Evaluation Of Functional Test Automation (FTA) Is Out And It's All About Going Beyond GUI Testing Archived 2015-05-28 at the Wayback Machine, by Diego Lo Giudice, Forrester April 23, 2015 <a href="http://blogs.forrester.com/diego_lo_giudice/15-04-23-the_forrester_wave_evaluation_of_functional_test_automation_fta_is_out_and_its_all_about_going_be?cm_mmc=RSS-_-BT-_-63-_-blog_1769" target="_blank">http://blogs.forrester.com/diego_lo_giudice/15-04-23-the_forrester_wave_evaluation_of_functional_test_automation_fta_is_out_and_its_all_about_going_be?cm_mmc=RSS-_-BT-_-63-_-blog_1769</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>Produce Better Software by Using a Layered Testing Strategy, by SEAN Kenefick, Gartner January 7, 2014 <a href="https://www.gartner.com/en/documents/2645817" target="_blank">https://www.gartner.com/en/documents/2645817</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>Testing APIs protects applications and reputations, by Amy Reichert, SearchSoftwareQuality March 2015 <a href="http://searchsoftwarequality.techtarget.com/tip/Testing-APIs-protects-applications-and-reputations" target="_blank">http://searchsoftwarequality.techtarget.com/tip/Testing-APIs-protects-applications-and-reputations</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>Onus for third-party APIs is on enterprise developers Archived 2019-07-31 at the Wayback Machine, by Amy Reichert, SearchSoftwareQuality July 2014 <a href="http://searchsoftwarequality.techtarget.com/tip/Onus-for-third-party-APIs-is-on-enterprise-developers" target="_blank">http://searchsoftwarequality.techtarget.com/tip/Onus-for-third-party-APIs-is-on-enterprise-developers</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>Testing APIs protects applications and reputations, by Amy Reichert, SearchSoftwareQuality March 2015 <a href="http://searchsoftwarequality.techtarget.com/tip/Testing-APIs-protects-applications-and-reputations" target="_blank">http://searchsoftwarequality.techtarget.com/tip/Testing-APIs-protects-applications-and-reputations</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>Produce Better Software by Using a Layered Testing Strategy, by SEAN Kenefick, Gartner January 7, 2014 <a href="https://www.gartner.com/en/documents/2645817" target="_blank">https://www.gartner.com/en/documents/2645817</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>Accelerate Development with Automated Testing[dead link], by Nathan Wilson, Gartner December 30, 2013 <a href="http://www.gartner.com/document/2642716" target="_blank">http://www.gartner.com/document/2642716</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>All About API Testing: An Interview with Jonathan Cooper, by Cameron Philipp-Edmonds, Stickyminds August 19, 2014 <a href="http://www.stickyminds.com/interview/all-about-api-testing-interview-jonathan-cooper" target="_blank">http://www.stickyminds.com/interview/all-about-api-testing-interview-jonathan-cooper</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>A Guidance Framework for Designing a Great Web API[dead link], by Eric Knipp and Gary Olliffe, Gartner August 20, 2014 <a href="http://www.gartner.com/document/2827918" target="_blank">http://www.gartner.com/document/2827918</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>The Fight Against Brittle Scripts and Software Defects, by Adrian Bridgwater, Dr. Dobb's Journal October 26, 2011 <a href="http://www.drdobbs.com/tools/the-fight-against-brittle-scripts-and-so/231901658" target="_blank">http://www.drdobbs.com/tools/the-fight-against-brittle-scripts-and-so/231901658</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>How Do We Learn Composite App Testing-Speak?, by Adrian Bridgwater, Dr. Dobb's Journal February 14, 2012 <a href="http://www.drdobbs.com/testing/how-do-we-learn-composite-app-testing-sp/232600874" target="_blank">http://www.drdobbs.com/testing/how-do-we-learn-composite-app-testing-sp/232600874</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>The Forrester Wave Evaluation Of Functional Test Automation (FTA) Is Out And It's All About Going Beyond GUI Testing Archived 2015-05-28 at the Wayback Machine, by Diego Lo Giudice, Forrester April 23, 2015 <a href="http://blogs.forrester.com/diego_lo_giudice/15-04-23-the_forrester_wave_evaluation_of_functional_test_automation_fta_is_out_and_its_all_about_going_be?cm_mmc=RSS-_-BT-_-63-_-blog_1769" target="_blank">http://blogs.forrester.com/diego_lo_giudice/15-04-23-the_forrester_wave_evaluation_of_functional_test_automation_fta_is_out_and_its_all_about_going_be?cm_mmc=RSS-_-BT-_-63-_-blog_1769</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>Produce Better Software by Using a Layered Testing Strategy, by SEAN Kenefick, Gartner January 7, 2014 <a href="https://www.gartner.com/en/documents/2645817" target="_blank">https://www.gartner.com/en/documents/2645817</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> <li id="fn:16"><p>The Forrester Wave Evaluation Of Functional Test Automation (FTA) Is Out And It's All About Going Beyond GUI Testing Archived 2015-05-28 at the Wayback Machine, by Diego Lo Giudice, Forrester April 23, 2015 <a href="http://blogs.forrester.com/diego_lo_giudice/15-04-23-the_forrester_wave_evaluation_of_functional_test_automation_fta_is_out_and_its_all_about_going_be?cm_mmc=RSS-_-BT-_-63-_-blog_1769" target="_blank">http://blogs.forrester.com/diego_lo_giudice/15-04-23-the_forrester_wave_evaluation_of_functional_test_automation_fta_is_out_and_its_all_about_going_be?cm_mmc=RSS-_-BT-_-63-_-blog_1769</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li> <li id="fn:17"><p>Produce Better Software by Using a Layered Testing Strategy, by SEAN Kenefick, Gartner January 7, 2014 <a href="https://www.gartner.com/en/documents/2645817" target="_blank">https://www.gartner.com/en/documents/2645817</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></p></li> <li id="fn:18"><p>Cohn, Mike (2009). Succeeding with Agile: Software Development Using Scrum. Addison-Wesley Professional. p. 312. ISBN 978-0321579362. <a href="978-0321579362" target="_blank">978-0321579362</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></p></li> <li id="fn:19"><p>J. Gao, C. Tao, D. Jie ĺ, S. Lu (2019). What is AI Software Testing? and Why. IEEE. pp. 27–2709. doi:10.1109/SOSE.2019.00015.{{cite book}}: CS1 maint: multiple names: authors list (link) <a href="https://ieeexplore.ieee.org/document/8705808/authors#authors" target="_blank">https://ieeexplore.ieee.org/document/8705808/authors#authors</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></p></li> </ol>