API Test Automation

1 The Hook — Why This Matters

In 2021, a Wellington SaaS startup lost a major client when their payment integration silently failed. The API returned HTTP 200 OK with a body that said {"status": "error", "message": "Card declined"}. The frontend parsed the JSON, saw "error," and showed a decline message. But the automation suite only checked the status code.

For three releases, the payment health check was green in CI while real customers could not complete purchases. The QA lead found it during a manual smoke test the day before go-live. The root cause? A junior automation engineer had written assert response.status_code == 200 and called it done.

APIs are not just about whether the server responds. They are about whether the contract is honoured. Status codes, headers, schema, and error bodies all matter. API testing done well finds defects in minutes that UI tests would take hours to surface.

2 The Rule — The One-Sentence Version

An API contract is a promise. The consumer promises to send valid JSON; the provider promises a defined shape back. Your job is to verify both sides of that promise, including what happens when someone breaks it.

3 The Analogy — Think Of It Like...

4 Watch Me Do It — Step by Step

Here is a real example testing a New Zealand employee API. Follow these steps for every endpoint you automate.

1. Read the contract Understand the method, required fields, headers, and expected status codes before writing a single line of test code.
2. Write the happy path first Create a valid request and assert status, schema, and critical field values.
3. Assert the schema, not just the data Use a schema validator or strict assertions to ensure the response shape does not drift.
4. Test negative cases with equal rigour Malformed payloads, missing auth, and invalid IDs should return predictable errors.
5. Verify headers and auth behaviour Content-Type, caching directives, and token expiry all affect production behaviour.

def test_create_employee():
    response = requests.post(
        "https://api.payroll.co.nz/v1/employees",
        json={"first_name": "Aria", "last_name": "Chen", "ird": "123456789"},
        headers={"Authorization": f"Bearer {token}"}
    )
    assert response.status_code == 201
    data = response.json()
    assert data["id"] is not None
    assert data["first_name"] == "Aria"
    assert data["created_at"]  # schema check

def test_create_employee_without_auth():
    response = requests.post(
        "https://api.payroll.co.nz/v1/employees",
        json={"first_name": "Aria", "last_name": "Chen"}
    )
    assert response.status_code == 401
    assert response.json()["error"] == "Missing authorization header"

from jsonschema import validate, ValidationError

def test_create_employee_schema():
    response = requests.post(
        "https://api.payroll.co.nz/v1/employees",
        json={"first_name": "Aria", "last_name": "Chen", "ird": "123456789"},
        headers={"Authorization": f"Bearer {token}"}
    )

    schema = {
        "type": "object",
        "properties": {
            "id": {"type": "string"},
            "first_name": {"type": "string"},
            "created_at": {"type": "string", "format": "date-time"},
        },
        "required": ["id", "first_name", "created_at"]
    }

    assert response.status_code == 201
    validate(instance=response.json(), schema=schema)  # validates structure

5 When to Use It / When NOT to Use It

6 Common Mistakes — Don't Do This

7 Now You Try — Interview Warm-Up

def test_get_invoice():
    response = requests.get(
        "https://api.billing.co.nz/v1/invoices/INV-2024-001",
        headers={"Authorization": f"Bearer {token}"}
    )
    assert response.status_code == 200
    data = response.json()
    # TODO: assert schema and business rules

    assert "id" in data
    assert data["status"] in {"draft", "sent", "paid", "overdue"}
    assert data["total"] > 0
    assert data["currency"] == "NZD"
    assert data["gst_amount"] == round(data["subtotal"] * 0.15, 2)

8 Self-Check — Can You Actually Do This?

Click each question to reveal the answer. If you got all three, you're ready to practice.

9 Interview Prep — What They'll Ask