REST Assured Tutorial for Java QA (2026 Complete Guide)

Last updated 2026-07-20 · 14 min read · By Avinash K

REST Assured has been the JVM API testing default for a decade because it reads like English. This tutorial takes you from Maven setup to production-grade framework — authentication, schema validation, request specs, and CI wiring — with 20 examples you can lift directly.

Key takeaways

• Maven and Gradle setup with the exact 2026 dependency versions.
• 20 examples: CRUD, auth, headers, JSON schema, XML.
• Given-When-Then DSL and how to keep specs DRY.
• Wiring REST Assured into JUnit 5 and Allure for CI reports.

<dependency>
  <groupId>io.rest-assured</groupId>
  <artifactId>rest-assured</artifactId>
  <version>5.5.0</version>
  <scope>test</scope>
</dependency>
<dependency>
  <groupId>io.rest-assured</groupId>
  <artifactId>json-schema-validator</artifactId>
  <version>5.5.0</version>
</dependency>

Full setup and language options in the official REST Assured site.

import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;

given()
    .baseUri("https://api.example.com")
    .header("Authorization", "Bearer " + token)
.when()
    .get("/orders/4211")
.then()
    .statusCode(200)
    .body("id", equalTo(4211))
    .body("items.size()", greaterThan(0))
    .time(lessThan(500L));

// POST
given().contentType("application/json")
       .body("{\"sku\":\"ABC\",\"qty\":2}")
   .when().post("/orders")
   .then().statusCode(201).body("id", notNullValue());

// PUT
given().contentType("application/json").body(updated)
   .when().put("/orders/4211")
   .then().statusCode(200);

// DELETE
when().delete("/orders/4211").then().statusCode(204);

// GET with query
given().queryParam("status", "shipped")
   .when().get("/orders")
   .then().body("size()", equalTo(12));

import static io.restassured.module.jsv.JsonSchemaValidator.matchesJsonSchemaInClasspath;

when().get("/orders/4211")
   .then().body(matchesJsonSchemaInClasspath("schemas/order.json"));

Ship the schema in src/test/resources/schemas/. Cross-reference our JSON tester for exploring paths interactively.

RequestSpecification api = new RequestSpecBuilder()
    .setBaseUri("https://api.example.com")
    .addHeader("Authorization", "Bearer " + token)
    .setContentType("application/json")
    .build();

given().spec(api).when().get("/orders/4211").then().statusCode(200);
given().spec(api).when().delete("/orders/4211").then().statusCode(204);

Add allure-rest-assured, register filter(new AllureRestAssured()), and every request appears in the Allure report with headers, body, and timing. Publish the Allure artifact from GitHub Actions. Bridge to your API testing interview prep and the Postman tutorial cluster for cross-tool depth.

Java shops running REST Assured across many services should read our microservices testing strategy next — it covers test data ownership and service virtualisation, the two things that break Java API suites at scale.