What are the best practices for API testing?

// BAD: test2 depends on test1 creating the user
@Test(dependsOnMethods = "createUser")
public void getUser() { ... }

// GOOD: each test sets up its own data
@Test
public void testGetUser() {
    int userId = createTestUser(); // own setup
    given().when().get("/api/users/" + userId).then().statusCode(200);
    deleteTestUser(userId);        // own cleanup
}

// BAD: repeat headers in every test
given().header("Authorization", "Bearer " + token)
       .header("Content-Type", "application/json")
       .when().get("/users");

// GOOD: reuse spec
given(requestSpec).when().get("/users");

// BAD: only check status
.then().statusCode(200);

// GOOD: validate status + body + headers + response time
.then()
.statusCode(200)
.contentType(ContentType.JSON)
.header("Content-Type", containsString("application/json"))
.body("data.id", notNullValue())
.body("data.email", matchesPattern(".+@.+\\..+"))
.time(lessThan(2000L));

@AfterMethod
public void cleanup() {
    if (createdUserId != null) {
        given(requestSpec)
            .when()
            .delete("/api/users/" + createdUserId);
    }
}

// BAD
@Test public void test1() { ... }

// GOOD
@Test public void testCreateUser_WithValidData_Returns201() { ... }
@Test public void testCreateUser_WithMissingEmail_Returns400() { ... }

// BAD: hardcoded credentials
String token = "abc123secrettoken";

// GOOD: from environment/config
String token = System.getenv("API_TOKEN");

<suite parallel="methods" thread-count="5">

// GOOD: only log when something fails
RestAssured.enableLoggingOfRequestAndResponseIfValidationFails();