REST API Basics

Before you can test APIs, you need to understand how they work. REST (Representational State Transfer) is the most common API architecture on the web.

What Is an API?

An API (Application Programming Interface) is a contract between two systems. The frontend asks for data, the backend provides it. The API defines the rules — which URLs to call, what data to send, and what to expect back.

HTTP Methods

REST APIs use HTTP methods to define what action to perform:

Request Structure

Every HTTP request has:

Method: POST
URL: https://api.example.com/users
Headers:
  Content-Type: application/json
  Authorization: Bearer eyJhbGciOi...
Body:
  {
    "name": "Sabaoon",
    "email": "sabaoon@example.com"
  }

• URL: Where to send the request
• Headers: Metadata (authentication, content type, caching)
• Body: The data you're sending (for POST, PUT, PATCH)
• Query parameters: Filters added to the URL (?page=2&limit=10)

Response Structure

Every HTTP response has:

Status: 201 Created
Headers:
  Content-Type: application/json
Body:
  {
    "id": 42,
    "name": "Sabaoon",
    "email": "sabaoon@example.com",
    "createdAt": "2026-03-12T10:00:00Z"
  }

Status Codes

Status codes tell you what happened:

2xx — Success

3xx — Redirection

4xx — Client Error

5xx — Server Error

REST Conventions

RESTful APIs follow predictable URL patterns:

GET    /users          → List all users
GET    /users/42       → Get user 42
POST   /users          → Create a new user
PUT    /users/42       → Replace user 42
PATCH  /users/42       → Update user 42
DELETE /users/42       → Delete user 42
GET    /users/42/posts → Get posts by user 42

Key rules:

• Use nouns, not verbs (/users, not /getUsers)
• Use plural names (/users, not /user)
• Use HTTP methods to express actions
• Nest related resources (/users/42/posts)

What API Testers Check

When testing an API, you verify:

1. Correct status code — Does GET /users/999 return 404?
2. Response body — Does the JSON contain the expected fields and values?
3. Headers — Is Content-Type correct? Are CORS headers present?
4. Performance — Does the response come back within acceptable time?
5. Error handling — Does the API return helpful error messages for bad input?
6. Authentication — Does it reject requests without valid tokens?