API Testing for QA Engineers

What's the difference between PUT and PATCH?

PUT replaces the entire resource and is idempotent; PATCH applies a partial update and may or may not be idempotent depending on operation.

How do you test authentication flows?

Cover happy path, expired token, invalid token, missing token, scope mismatch, refresh, and revocation; assert on status, body, and headers.

What is contract testing?

Verifying that provider and consumer agree on API shape and behaviour via a shared contract — Pact is the most common tool.

Explain idempotency with an example.

Calling DELETE /users/1 twice should produce the same final state (user gone). Useful for retries to avoid duplicate side effects.

How do you validate response schemas?

Use JSON Schema, OpenAPI, or library matchers (e.g. REST Assured's matchesJsonSchema) to assert structure and types.

How do you handle test data for APIs?

Factory functions, fixtures per test, and clean-up hooks. Avoid shared mutable test data across runs.

How do you do API testing in CI?

Run Newman collections or REST Assured suites in GitHub Actions/Jenkins, publish reports, and gate merges on critical-flow failures.

What status codes do you assert on for a created resource?

201 for synchronous creation, 202 for async accepted, plus body assertions and Location header on the new resource.

How would you test a paginated endpoint?

Validate page size, sort order, boundary pages, invalid page params, total count, and link/cursor stability.

What is service virtualisation?

Simulating dependent services with controllable responses so tests can run reliably without the real service.