kevinnft API Testing — Automated Endpoint Validation
Test REST and GraphQL APIs with automated validation. Verify endpoints, status codes, response schemas, performance, and security. Ensure API contracts are maintained across changes.
When to Use
- Testing REST/GraphQL endpoints
- Validating API responses
- Contract testing between services
- Performance testing APIs
- Security testing endpoints
- CI/CD API validation
Testing Approaches
1. Manual Testing (curl)
# GET request
curl -X GET https://api.example.com/users
# POST with JSON
curl -X POST https://api.example.com/users \
-H "Content-Type: application/json" \
-d '{"name": "John", "email": "john@example.com"}'
# With authentication
curl -X GET https://api.example.com/profile \
-H "Authorization: Bearer YOUR_TOKEN_HERE"
# Save response
curl -X GET https://api.example.com/users -o response.json
# Show headers
curl -i https://api.example.com/users
# Verbose output
curl -v https://api.example.com/users
2. Automated Testing (Python + requests + pytest)
import requests
import pytest
BASE_URL = "https://api.example.com"
def test_get_users():
response = requests.get(f"{BASE_URL}/users")
# Status code
assert response.status_code == 200
# Response structure
data = response.json()
assert isinstance(data, list)
assert len(data) > 0
# First user structure
user = data[0]
assert "id" in user
assert "name" in user
assert "email" in user
def test_create_user():
payload = {
"name": "John Doe",
"email": "john@example.com"
}
response = requests.post(
f"{BASE_URL}/users",
json=payload
)
assert response.status_code == 201
data = response.json()
assert data["name"] == payload["name"]
assert data["email"] == payload["email"]
assert "id" in data
def test_authentication_required():
response = requests.get(f"{BASE_URL}/profile")
assert response.status_code == 401
def test_invalid_data():
payload = {"name": ""} # Invalid: empty name
response = requests.post(
f"{BASE_URL}/users",
json=payload
)
assert response.status_code == 400
assert "error" in response.json()
def test_not_found():
response = requests.get(f"{BASE_URL}/users/99999")
assert response.status_code == 404
3. Schema Validation (jsonschema)
import requests
from jsonschema import validate
user_schema = {
"type": "object",
"properties": {
"id": {"type": "integer"},
"name": {"type": "string"},
"email": {"type": "string", "format": "email"},
"created_at": {"type": "string", "format": "date-time"}
},
"required": ["id", "name", "email"]
}
def test_user_schema():
response = requests.get(f"{BASE_URL}/users/1")
data = response.json()
# Validate against schema
validate(instance=data, schema=user_schema)
4. GraphQL Testing
def test_graphql_query():
query = """
query {
users {
id
name
email
}
}
"""
response = requests.post(
f"{BASE_URL}/graphql",
json={"query": query}
)
assert response.status_code == 200
data = response.json()
assert "data" in data
assert "users" in data["data"]
assert len(data["data"]["users"]) > 0
Testing Patterns
1. Setup/Teardown
import pytest
@pytest.fixture
def test_user():
"""Create test user, cleanup after test"""
# Setup
response = requests.post(
f"{BASE_URL}/users",
json={"name": "Test User", "email": "test@example.com"}
)
user = response.json()
yield user
# Teardown
requests.delete(f"{BASE_URL}/users/{user['id']}")
def test_with_fixtures(test_user):
response = requests.get(f"{BASE_URL}/users/{test_user['id']}")
assert response.status_code == 200
2. Parametrized Tests
@pytest.mark.parametrize("endpoint,expected_status", [
("/users", 200),
("/posts", 200),
("/comments", 200),
("/invalid", 404),
])
def test_endpoints(endpoint, expected_status):
response = requests.get(f"{BASE_URL}{endpoint}")
assert response.status_code == expected_status
3. Performance Testing
import time
def test_response_time():
start = time.time()
response = requests.get(f"{BASE_URL}/users")
duration = time.time() - start
assert response.status_code == 200
assert duration < 1.0 # Must respond within 1 second
4. Contract Testing
def test_api_contract():
"""Ensure API contract hasn't changed"""
response = requests.get(f"{BASE_URL}/users/1")
user = response.json()
# Required fields must exist
required_fields = ["id", "name", "email", "created_at"]
for field in required_fields:
assert field in user, f"Missing required field: {field}"
# Field types must match
assert isinstance(user["id"], int)
assert isinstance(user["name"], str)
assert isinstance(user["email"], str)
Best Practices
1. Test Error Cases
def test_error_cases():
# Invalid data
response = requests.post(f"{BASE_URL}/users", json={})
assert response.status_code == 400
# Unauthorized
response = requests.get(f"{BASE_URL}/profile")
assert response.status_code == 401
# Not found
response = requests.get(f"{BASE_URL}/users/99999")
assert response.status_code == 404
2. Test Pagination
def test_pagination():
response = requests.get(f"{BASE_URL}/users?page=1&limit=10")
data = response.json()
assert "items" in data
assert "total" in data
assert "page" in data
assert len(data["items"]) <= 10
Running Tests
# Run all tests
pytest tests/api/
# Run with coverage
pytest tests/api/ --cov
# Run specific test
pytest tests/api/test_users.py::test_get_users
# Run with verbose output
pytest tests/api/ -v