What are the different types of API testing?

1. Functional Testing

Verifies that the API works as specified — correct inputs return correct outputs.

// Test: POST /users creates a user and returns 201
given()
    .body("{ \"name\": \"John\" }")
    .contentType(ContentType.JSON)
    .when()
    .post("/api/users")
    .then()
    .statusCode(201)
    .body("name", equalTo("John"));

2. Integration Testing

Tests how multiple APIs or services work together.

• ✓Login → Get Token → Use Token to Access Protected Resource

3. Load / Performance Testing

Checks API behavior under expected and peak loads.

• ✓Tools: JMeter, k6, Gatling
• ✓Metrics: response time, throughput, error rate under 100, 500, 1000 concurrent users

4. Security Testing

Verifies the API is protected against common vulnerabilities:

• ✓SQL Injection — malicious SQL in request params
• ✓XSS — script injection in body fields
• ✓Auth bypass — accessing resources without valid token
• ✓IDOR — accessing another user's data by changing ID
• ✓Rate limiting — brute force protection

5. Negative Testing

Tests that invalid inputs are handled gracefully:

• ✓Missing required fields → 400
• ✓Invalid data types → 400 / 422
• ✓Non-existent resources → 404
• ✓Expired tokens → 401

6. Contract Testing

Verifies the API response structure matches the agreed schema.

• ✓Tools: Pact, JSON Schema Validator

7. Regression Testing

Re-runs existing tests after code changes to catch regressions.

8. End-to-End (E2E) Testing

Tests complete business workflows across multiple APIs:

1. ✓Register user
2. ✓Login → get token
3. ✓Create order
4. ✓Make payment
5. ✓Verify order status

9. Compatibility Testing

Verifies API works across different:

• ✓API versions (v1, v2, v3)
• ✓Client types (mobile, web, third-party)
• ✓Response formats (JSON, XML)

         [E2E Tests]     ← few, slow, expensive
       [Integration Tests]
    [Contract / Schema Tests]
  [Functional API Tests]    ← many, fast, cheap