Lesson 1 of 85 min read
What an API is and why testers test it
An API is how one program asks another program for data or to do something. Most bugs that reach users start in the API layer, so testing it is one of the most valued QA skills.
Key takeaways
- 1Think of a restaurant: you (the app) give an order to the waiter (the API), who brings it from the kitchen (the server and database).
- 2When you open a shopping app, the screen calls APIs like GET /products to load items and POST /orders to place an order.
- 3API tests check the logic directly, without the screen. They are faster, more stable and catch bugs earlier than UI tests.
One screen, many API calls
Product page loads: 1. GET /products/12 - product name, price, stock 2. GET /cart - items already in your cart 3. POST /cart/items - when you tap 'Add to cart' If step 3 returns the wrong total, the screen will show the wrong total too. An API test finds that in milliseconds.
Go deeper
Expert notes beyond the basics
- 01
REST is the style you will see most
Most APIs you test are REST APIs: each URL is a thing (a product, an order) and the HTTP method says what to do with it. You may also meet GraphQL (one endpoint, you ask for exact fields) and SOAP (older, XML), but the testing mindset is the same.
- 02
Where API tests sit in the test pyramid
Many unit tests at the bottom, a solid layer of API tests in the middle, and a few UI tests on top. API tests give the best balance of speed, stability and real business coverage.
- 03
APIs are contracts, not just URLs
An API is a contract between two systems: it promises certain inputs will produce certain outputs, in a certain shape, with certain error behaviour. When you test an API, you are really testing whether the contract is honoured. This matters because other teams, mobile apps and third parties build on that contract without seeing your code, so a broken contract breaks things far from where the bug was introduced.
- 04
Public, internal and partner APIs
Not every API is the same. Public APIs face external developers and need strict versioning and documentation. Internal APIs connect your own services and can change faster, but still need tests because many features depend on them. Partner APIs sit in between, often with contracts and SLAs. As a tester, ask who consumes the API before deciding how strict your checks and regression coverage need to be.
Common mistakes to avoid
- - Thinking API testing needs advanced coding. You can start with Postman and no code.
- - Only testing through the UI and missing rules the UI hides.
- - Assuming an API with good documentation needs no testing because 'it is already proven'.
- - Treating every API the same, instead of asking who consumes it and how critical it is.
Try it yourself
Open any shopping app or website, press F12, go to the Network tab and filter by Fetch/XHR. Name two API calls you see.
Write your answer on paper or in a sheet first, then compare.
Interview questions
How to answer like a confident QA engineer
- Q1
Why test APIs if we already test the UI?
Model answer
The UI only shows what the API returns. API tests check business rules, validation and security directly, run in seconds, break less often than UI tests, and catch bugs before a screen even exists. They also cover cases the UI blocks, such as sending invalid data on purpose.
- Q2
What is an endpoint?
Model answer
A specific URL plus method that does one job, for example GET /products/{id} returns one product.
- Q3
What is the difference between an API and a web service?
Model answer
A web service is a type of API that communicates over a network, usually HTTP. All web services are APIs, but not all APIs go over a network; some are libraries or operating-system interfaces used inside one program.
- Q4
Why are API tests usually faster and more stable than UI tests?
Model answer
They skip rendering, animations and browser quirks, and call the logic directly with plain HTTP requests. There is far less that can randomly fail, so they run in milliseconds and rarely flake, which makes them ideal for frequent regression runs.
Knowledge check
+5 points
What does an API mainly do?