A Cheat Sheet (DRAFT) by AnuArun

API testing is the process of testing an Applic­ation Progra­mming Interface (API) to validate its functi­ona­lity, reliab­ility, security, and perfor­mance.

Postman is one of the most widely used API testing tools that allows testers and developers to send API requests and validate the responses without using the applic­ation's user interface. It supports testing REST and SOAP APIs and helps verify response status codes, response body, response time, authen­tic­ation, headers, and error handling.

REST (Repre­sen­tat­ional State Transfer) and SOAP (Simple Object Access Protocol) are both used for commun­ication between Applic­ations, but they work differently.

My unnder­staning is that
REST APIs commonly exchange data in JSON format over HTTP or HTTPS.
SOAP APIs use XML messages and follow strict rules for Security and Messaging.

REST is commonly used for Web Applic­ations, Mobile Applic­ations, and Micros­ervices because it is simple and fast.
SOAP is commonly used in Enterprise Applic­ations, such as Banking and Healthcare, where Security and Reliab­ility are important.

Collec­tions allow multiple API requests to be organised into a single reusable group.
e.g., all requests for the Worker Screening API

In API testing, we send a request to the API using known input data and then analyse the response returned by the server.

○ To address this, I verify the accuracy of the response data, HTTP status code, response time, error codes returned by the API, authen­tic­ation and author­ization behaviour, non-fu­nct­ional aspects such as * perfor­mance and security.

○ There are several ways to verify that the returned data is correct.
--The simplest method is checking whether the API returns the expected status code.
--Another method is writing assertions.
--I commonly create assertions to validate the response time, status code, status code descri­ption, response type, response headers, and specific values or strings within the response body.

Positive Testing verifies that an API behaves correctly when valid data is provided.
Negative Testing verifies that the API handles invalid requests correctly without crashing or exposing unexpected behaviour.

Yes.
POST is primarily used to create new resources on the Server.
My role while testing POST APIs is to verify that the resource is succes­sfully created and that the API returns the correct Response.
To address this, I validate the Request Payload, execute the API, verify the HTTP Status Code, confirm the Response Body, and check that the newly created data exists within the Applic­ation or Database, where applicable.
As a result, I can confirm that the API succes­sfully creates new resources and behaves according to the Business Requir­ements.

A Payload is the actual data sent from the Client to the Server as part of an API Request.
My role while testing APIs is to ensure that the Payload contains the correct inform­ation before sending the request.
To address this, I validate the Payload Structure, Field Names, Mandatory Fields, Data Types, and Business Values before executing the request.
I also verify that the API processes the Payload correctly and returns the expected Response.
As a result, I can confirm that the API correctly accepts, validates, and processes the incoming data.

An HTTP Request consists of several important compon­ents.

2. Uniform Resource Identifier (URI), which represents the endpoint where the API is hosted.

4. Request Header, which carries metadata as key-value pairs, such as Conten­t-Type, Author­ization tokens, Accept, and other request inform­ation.

--Toge­ther, these components make up a complete HTTP Request.

Authen­tic­ation and Author­ization are both used to secure APIs, but they serve different purposes.
Authentication = Who are you? (Identity Verifi­cation)
Authorization = What can you access? (Permi­ssion Verifi­cation)

Author­ization determines what an authen­ticated user is allowed to access or perform. It answers the question, "What are you allowed to do?"
It checks the user's roles, permis­sions, or access rights before allowing access to a resource.

Some of the commonly used Authen­tic­ation techniques include
○Session or Cookie­-Based Authen­tic­ation,
○Basic Authen­tic­ation,
○Digest Authen­tic­ation, and
○OAuth.

○Basic Authen­tic­ation uses a Username and Password encoded within the Request.

○OAuth is widely used for modern Web Applic­ations because it provides secure Token-­Based Authen­tic­ation without exposing User Creden­tials.

Variables are used to store reusable values that can be referenced throughout a Postman Collection.
• Defined using double curly braces: {{variable_name}}
• Can be used in URLs, Headers, Request Body, and Scripts.

--Variables allow values to be stored and reused throughout API requests.
--My role while using variables is to eliminate hardcoded values and improve mainta­ina­bility.
--To address this, I use Global Variables, Collection Variables, Enviro­nment Variables, Local Variables, and Data Variables depending on the testing scenario.
--For example, instead of hardcoding the Base URL in every request, I store it as an Enviro­nment Variable. If the enviro­nment changes from Develo­pment to UAT, I simply switch the Enviro­nment without modifying each request individually.
--As a result, variables make API requests easier to maintain, more reusable, and less prone to manual errors.

Global Variables are accessible across every Collection and Enviro­nment within the workspace.

Collection Variables are available only within a specific Collection, regardless of which Enviro­nment is selected.

As a result, unders­tanding Variable Scope helps prevent conflicts, improves mainta­ina­bility, and keeps API requests organised and reusable.