How do you perform API performance testing and what tools do you use?

Answer

API Performance Testing

Performance testing verifies that APIs respond within acceptable time limits under expected and peak loads.

Types of Performance Tests

Type	Description	Example
Load Test	Expected concurrent users	100 users, 5 minutes
Stress Test	Beyond normal capacity	500-1000 users until failure
Spike Test	Sudden traffic increase	Spike from 10 to 1000 users
Soak Test	Sustained load over time	100 users for 2 hours
Endurance Test	Long-duration stability	50 users for 24 hours

Tool 1: Apache JMeter

Test Plan for API:

XML

Thread Group:
  - Number of Threads: 100
  - Ramp-Up Period: 10 seconds
  - Loop Count: 10

HTTP Request:
  - Method: GET
  - URL: https://api.example.com/users
  - Header: Authorization: Bearer {{token}}

Assertions:
  - Response Assertion: Status Code = 200
  - Duration Assertion: Response time < 2000ms

Listeners:
  - Summary Report
  - Response Time Graph
  - Active Threads Over Time

Tool 2: k6 (Modern Performance Testing)

JavaScript

import http from 'k6/http';
import { check, sleep } from 'k6';

export let options = {
    stages: [
        { duration: '30s', target: 20 },   // Ramp up to 20 users
        { duration: '1m',  target: 100 },  // Stay at 100 users
        { duration: '20s', target: 0 },    // Ramp down
    ],
    thresholds: {
        http_req_duration: ['p(95)<500'],  // 95% requests < 500ms
        http_req_failed:   ['rate<0.01'],  // Error rate < 1%
    }
};

export default function() {
    const res = http.get('https://api.example.com/users', {
        headers: { Authorization: 'Bearer your-token' }
    });

    check(res, {
        'status is 200': (r) => r.status === 200,
        'response time < 500ms': (r) => r.timings.duration < 500,
    });

    sleep(1); // 1 second think time
}

Run k6:

Bash

k6 run --out influxdb=http://localhost:8086/k6 load-test.js

Baseline Performance Checks in Rest Assured

Java

@Test
public void testGetUsersResponseTime() {
    long startTime = System.currentTimeMillis();

    Response response = given()
                            .header("Authorization", "Bearer " + token)
                            .when()
                            .get("/api/users");

    long responseTime = System.currentTimeMillis() - startTime;

    assertEquals(response.getStatusCode(), 200);
    assertTrue(responseTime < 1000, "Response time exceeded 1 second: " + responseTime + "ms");
}

// Rest Assured built-in time assertion
@Test
public void testResponseTimeWithRestAssured() {
    given()
        .when()
        .get("/api/users")
        .then()
        .statusCode(200)
        .time(lessThan(2000L)); // 2 seconds
}

Key Metrics to Monitor

Metric	Target
Response Time (avg)	< 200ms
Response Time (p95)	< 500ms
Response Time (p99)	< 1000ms
Throughput	> 1000 req/sec
Error Rate	< 0.1%
CPU Usage	< 70% under load
Memory Usage	Stable (no leaks)