API Testing

API Testing

Test Structure

What to Test

1. Happy path: Valid request → expected response
2. Validation: Invalid input → 400/422 with error details
3. Auth: Unauthenticated → 401; unauthorized → 403
4. Not found: Invalid ID → 404
5. Edge cases: Empty body, missing required fields, type mismatches

Request/Response Assertions

• Status code matches expectation
• Response body shape (keys present, types correct)
• Error messages are present and meaningful
• No sensitive data in responses (tokens, internal IDs if applicable)

Test Organization

tests/
├── api/
│   ├── auth.test.ts
│   ├── users.test.ts
│   └── products.test.ts

Group by resource or feature. Use describe for endpoint, it for scenario.

Setup/Teardown

• Use test database or mocks; never hit production
• Seed minimal data per test when needed
• Clean up created resources in afterEach or use transactions

Example Pattern (supertest-style)

it('returns 400 when email is invalid', async () => {
  const res = await request(app)
    .post('/api/users')
    .send({ email: 'invalid', name: 'Test' });
  expect(res.status).toBe(400);
  expect(res.body.error.details).toContainEqual(
    expect.objectContaining({ field: 'email' })
  );
});