2026 Complete API & REST Assured Guide for SDETs

Complete API Testing Guide:
Postman, REST Assured, JSON Logic & Security

Master API testing concepts tailored for QA Engineers and SDETs. Learn HTTP methods, Postman test collections, REST Assured Java BDD code ('given().when().then()'), JSON Schema validation, and OAuth authentication.

HTTP & REST Protocols GET, POST, PUT, DELETE & Headers

Postman Testing Collections, Environment & Scripts

REST Assured Automation Java BDD & Response Assertions

API Security QA OAuth 2.0, JWT Tokens & Rate Limits

🌐 API Testing Career Pathway

5-Step API Testing Career Path for SDETs

Master API testing step-by-step: HTTP & REST → Postman Collections → JSON Logic → REST Assured Java Automation → API Security & CI/CD.

Step 1: HTTP & REST Basics

Master HTTP Request methods (GET, POST, PUT, DELETE), status codes (2xx, 4xx, 5xx), and headers.

Study HTTP Basics →

Step 2: Postman Testing

Create Postman collections, environment variables, pre-request scripts, and test assertions.

Master Postman →

Step 3: JSON & Security

JSON Schema validation, OAuth 2.0, Bearer JWT tokens, API keys, and rate limit testing.

Study JSON & Security →

Step 4: REST Assured Code

Build Java REST Assured frameworks with given().when().then(), POJO serialization, and TestNG.

Build REST Assured →

Step 5: SOAP vs REST & CI/CD

Compare REST vs SOAP web services and integrate Postman Newman into Jenkins CI/CD.

Explore Web Services →

🛠️ Interactive API Learner & Developer Suite

⚡ Interactive Tool 1

Interactive HTTP Request & Header Sandbox

Select an HTTP Method and endpoint parameters below to inspect generated request headers and JSON payloads.

💡 How This Tool Works for Students: Select an HTTP Method (GET, POST, PUT, DELETE). The tool constructs formatted HTTP headers and JSON bodies live!

HTTP Method

API Endpoint Path

🧪 Interactive Tool 2

REST Assured Java BDD Test Code Generator

Auto-generate production REST Assured Java BDD code ('given().when().then()') with status code and JSON assertions.

💡 How This Tool Works for Students: Type expected status code and response fields to generate complete REST Assured Java test scripts!

Expected Status Code

Assert JSON Key Field

📊 Interactive Tool 3

HTTP Status Code Matrix & Decision Tool

Click a status code to inspect its meaning, category, and real-world QA assertion scenarios.

💡 How This Tool Works for Students: Select any HTTP Status Code (200, 201, 400, 401, 404, 500) to view its exact testing scenario!

⏱️ Interactive Tool 4

Timed API Testing & REST Assured Quiz

Time Left: 05:00

Test your real-time knowledge on HTTP methods, REST Assured BDD syntax, status codes, and authentication tokens.

💡 How This Tool Works for Students: Select an option choice below. If correct, the choice turns green and reveals a detailed explanation!

1. What is the key difference between PUT and PATCH HTTP methods?

Score: 0 / 5

Module 1: API Testing Fundamentals Explained Step-by-Step

How APIs Work in Plain English & Hinglish (Student Guide)

An API (Application Programming Interface) is a messenger that takes your request, tells a system what you want to do, and returns the response back to you. Here is the step-by-step breakdown:

1. Real-World Waiter Analogy

English: Imagine sitting at a restaurant table (Client). You look at the menu and give your order to the Waiter (API). The waiter takes your order to the Kitchen (Database/Server) and brings back your prepared meal (Response).

2. Hinglish Explanation

Hinglish: API do alag systems ke beech ka bridge (setu) hota hai. Jaise Swiggy app Zomato/Restaurant ke database se live food menu and prices laane ke liye API call karta hai!

3. Why We Test APIs First

Why API Testing?: API testing happens at the Business Logic Layer (without browser UI). Tests run 10x to 100x faster, enabling early defect detection in Agile sprints!

Step-by-Step API Request & Response Lifecycle

                        [ Client / Postman / REST Assured ]
(Sends HTTP Request + Headers + Body)
                    
→ HTTP Protocol →

                        [ API Gateway / Endpoint ]
(Authenticates Bearer Token & Validates JSON)
                    
→ Database Query →

                        [ Server Response ]
(Returns Status Code 200 + JSON Response)
                    

3. Difference between Query Parameters and Path Parameters?

English: Path Parameters: Part of the URL (e.g., /users/123). Query Parameters: Appended after ? (e.g., /users?age=25) and used for filtering.
Hinglish: Path param URL ka hi hissa hota hai; Query param ? ke baad lagaya jata hai filter aur sorting ke liye.

3. Difference between PUT and PATCH?

English: PUT: Replaces entire resource. PATCH: Updates only specific fields (Partial update).
Hinglish: PUT poora badal deta hai; PATCH thoda sa part badalta hai (like sirf phone number).

2. How to test an API that has no documentation?

English: Use tools like Fiddler, Charles Proxy, or Chrome Network tab to capture requests while interacting with the application UI.
Hinglish: Proxy tools use karke ye pata lagao ki UI kaunsi calls kar raha hai.

3. What is 'API Mocking'?

English: Simulating the behavior of a real API with fake responses. Useful when the backend is not ready but frontend/testing must proceed.
Hinglish: Asli API banne se pehle uski nakal (fake API) banana testing ke liye.

4. Difference between 401 Unauthorized and 403 Forbidden?

English: 401: Identity unknown (no valid credentials). 403: Identity known but access denied (no permission for this resource).
Hinglish: 401 matlab user login nahi hai; 403 matlab login toh hai par use ye dekhne ki ijazat nahi hai.

5. What is 'Contract Testing' in API?

English: Verifying that the API provider (server) and consumer (client) agree on the structure of data exchanged.
Hinglish: Ye check karna ki Client aur Server dono response format (keys/types) pe agree kar rahe hain.

5. Describe a challenging situation with developers or deadlines and how you handled it.

"Once we had a major release with tight deadlines. Developers delivered changes very late. Instead of pushing back, I prioritized critical test cases first, used automation scripts to speed up regression, collaborated closely with devs for quick fixes, and escalated blockers early. As a result, we delivered on time with good quality."

7. How to raise a defect in Jira tool?

Click on Create Issue.
Select Issue Type as Bug.
Enter Summary and Description.
Add exact Steps to Reproduce.
Mention Expected and Actual Result.
Attach screenshots/logs.
Click Submit.

8. What is UNION in SQL?

English: UNION is an SQL operator used to combine the result of two or more SELECT queries into a single result set. Both queries must have the same number of columns and compatible data types. By default, it removes duplicates.
Hinglish: UNION ek SQL operator hai jo do ya zyada SELECT queries ko combine karta hai.

4. What is the difference between Idempotent and Non-Idempotent HTTP Methods?

Step-by-Step Explanation:

Idempotent Methods (GET, PUT, DELETE, HEAD, OPTIONS): Sending the exact same request 1 time or 100 times produces the exact same server state. (e.g. DELETE /users/10 deletes user 10; subsequent deletes return 404/204 without changing server state further).
Non-Idempotent Methods (POST): Sending the exact same request 5 times creates 5 new duplicate database records!

5. What is the difference between Path Variables and Query Parameters in API Requests?

Step-by-Step Comparison:

Path Variables (/api/v1/users/{userId}): Used to identify a specific resource. Part of the URL path itself.
Query Parameters (/api/v1/users?status=active&page=2): Used to filter, sort, or paginate resources. Starts after ? symbol.

// REST Assured Syntax:
given()
    .pathParam("userId", 101)       // Path Param
    .queryParam("status", "active") // Query Param
.when()
    .get("/api/v1/users/{userId}");

Module 2: HTTP Protocol & REST Concepts

1. Difference between GET vs POST vs PUT vs DELETE

✅ Answer (English):
These are HTTP methods used to perform different operations on server:

GET: Used to retrieve data from server (no data change)
POST: Used to create new data
PUT: Used to update existing data (complete update)
DELETE: Used to delete data

Real-time Example (User API):

GET → Get user details
POST → Create new user
PUT → Update user profile
DELETE → Delete user

✅ Answer (Hinglish):

GET → data fetch karta hai
POST → naya data create karta hai
PUT → data update karta hai
DELETE → data delete karta hai

🎯 Interview Tip: Bolna: "GET is read-only, POST creates, PUT updates, DELETE removes data"

3. What is a Collection in Postman?

✅ Answer (English):
A Collection in Postman is a group of API requests saved together. It helps to organize APIs, reuse them, and run multiple requests in sequence.

Example: Login API, User API, Payment API → all stored in one collection.

✅ Answer (Hinglish):
Collection Postman me APIs ka folder hota hai jisme multiple requests store hoti hain.

🎯 Interview Tip: Mention: "Used for organization and execution of APIs"

2. What is Postman and what are its core features?

English: Postman is a tool for developing and testing APIs. Features include collections, environments, global variables, and automated tests (JS scripts).
Hinglish: Postman API testing ka best tool hai jisme requests save karne (Collections) aur test script likhne ke features hain.

4. What are Global, Collection, and Environment variables in Postman?

English: Global: All-in-one. Collection: Within one folder. Environment: Specific to a setup like QA or Prod.
Hinglish: Global har jagah apply hote hain; Environment sirf chune gaye mode (QA/Prod) pe; Collection sirf us group pe.

5. How to automate tests in Postman?

English: By writing JavaScript code in the "Tests" tab of a request (using the pm.test() function).
Hinglish: Postman ke "Tests" tab mein JS script likh kar assertions/checks lagaye ja sakte hain.

2. Difference between GET and POST?

English: GET: Fetches data (data in URL, limited size). POST: Sends data (data in body, secure, no size limit).
Hinglish: GET data laata hai aur URL mein dikhta hai; POST data bhejne ke liye hota hai aur jyadatar body mein hidden hota hai.

5. What is 'Idempotency' in API methods?

English: A method is idempotent if calling it multiple times has the same outcome (e.g., GET, PUT, DELETE). POST is NOT idempotent.
Hinglish: Agar method baar-baar chalane pe same result de toh wo idempotent hai (jaise PUT ya DELETE).

6. How to handle OAuth 2.0 Authentication in REST Assured?

Step-by-Step BDD Code Example:

First fetch the access token from the token endpoint, then pass it using oauth2() header authentication:

// Step 1: Fetch Access Token
String token = given()
    .formParam("grant_type", "client_credentials")
    .formParam("client_id", "my_client_id")
    .formParam("client_secret", "my_secret")
.when()
    .post("https://auth.example.com/oauth/token")
.then()
    .extract().path("access_token");

// Step 2: Use Token in API Request
given()
    .auth().oauth2(token) // Applies Bearer Header!
.when()
    .get("/api/v1/secure-dashboard")
.then()
    .statusCode(200);

7. What is JSON Schema Validation and how do you implement it in REST Assured?

Step-by-Step Explanation: JSON Schema validation ensures the response body adheres to expected data types (String, Number, Boolean) and mandatory key structures, preventing broken API contracts.

// REST Assured JSON Schema Assertion
given()
    .get("/api/v1/users/10")
.then()
    .assertThat()
    .body(matchesJsonSchemaInClasspath("user-schema.json"));

Module 3: JSON Schema & API Security

4. What is API chaining in Postman?

✅ Answer (English):
API chaining means passing data from one API response to another API request.

Example:

Login API → returns token
Use same token in next API (Get User)

pm.environment.set("token", pm.response.json().token);

✅ Answer (Hinglish):
Ek API ka response dusri API me use karna → API chaining.

🎯 Interview Tip: "Used for end-to-end testing flow"

6. How do you test APIs using Postman?

✅ Answer (English):

Open Postman
Select method (GET/POST etc.)
Enter API URL
Add headers (if needed)
Add body (for POST/PUT)
Click Send
Validate response using tests

Example (POST API JSON body):

{
  "name": "Ram",
  "email": "ram@test.com"
}

✅ Answer (Hinglish):
Postman open karo, method aur URL enter karo, header/body add karke Send click karo, phir response check karo.

🎯 Interview Tip: "We can automate APIs using Postman scripts and run collections using Collection Runner"

1. What is an API and why is it tested?

English: API (Application Programming Interface) is a set of rules that allows two software components to communicate. We test it to ensure data integrity, security, and backend reliability.
Hinglish: API do softwares ke beech pul ka kaam karti hai. Iska test data aur logic check karne ke liye hota hai.

1. What is JSON and why it is preferred over XML?

English: JSON (JavaScript Object Notation) is lightweight, faster to parse, and more human-readable compared to XML.
Hinglish: JSON halka aur fast hota hai, aur iska code padhne mein XML se aasan hai.

2. How do you handle Authentication in APIs?

English: Using headers like Authorization: Bearer <token>, API Keys, or Basic Auth (Username:Password).
Hinglish: Header mein token ya keys daal kar user ki pehchan process ki jati hai.

3. Explain OAuth 2.0 briefly.

English: An authorization protocol where a client gets an 'Access Token' to perform actions on behalf of a user without sharing passwords.
Hinglish: Bina password bataye permission lene ka tareeka (जैसे Login with Google).

4. What is 'Payload' and 'Headers'?

English: Payload: Data sent in the body. Headers: Metadata information (like Content-Type: application/json).
Hinglish: Payload asli data hota hai; Header request ke baare mein informatio hoti hai.

5. What are common API security risks?

English: Injection attacks, Broken Object Level Authorization (BOLA), Unprotected endpoints, and Excessive data exposure.
Hinglish: API hacking ki threats jaise purana login use karna ya galti se security gaps chodh dena.

1. What is Microsoft Graph API?

English: Microsoft Graph API is a RESTful web API provided by Microsoft that allows developers to access and manage data from multiple Microsoft services like Outlook, OneDrive, Teams, and Azure Active Directory using a single endpoint. It acts as a central gateway to interact with Microsoft cloud services and uses OAuth 2.0 for secure authentication.

Hinglish: Microsoft Graph API ek REST API hai jo Microsoft provide karta hai. Iska use karke hum Microsoft ke different services jaise Outlook, OneDrive, Teams aur Azure Active Directory ka data ek hi endpoint se access aur manage kar sakte hain. Ye ek central gateway ki tarah kaam karta hai aur secure authentication ke liye OAuth 2.0 use karta hai.

6. How to handle large JSON responses?

English: Using JSON Path expressions to parse and validate specific fields instead of checking the whole string.
Hinglish: JSON Path use karke sirf kaam ki cheezein pick karo pure response ko padhne ke bajaye.

4. Tell me about a time you identified a critical bug through automation.

"During a regression run, automation flagged a scenario where deactivated/inactive users were still able to log in. I immediately analyzed logs & captured screenshots, reported the issue with priority, and informed the development team. It was a security bug. Automation helped catch it early before production, saving a lot of manual effort and risk."

5. What is Serialization and Deserialization in API Automation?

Step-by-Step Explanation:

Serialization: Converting a Java POJO (Plain Old Java Object) into a JSON/XML payload string before sending the HTTP request.
Deserialization: Converting the returned JSON response string back into a Java POJO object for easy getters/assertions.

// Serialization (POJO -> JSON)
UserPOJO user = new UserPOJO("John", "SDET");
given().body(user).post("/api/users");

// Deserialization (JSON -> POJO)
UserPOJO responseUser = given().get("/api/users/1").as(UserPOJO.class);
System.out.println(responseUser.getName());

Module 4: Scenario-Based API Testing Q&As

2. Different types of status codes

✅ Answer (English):
Status codes show server response status:

1xx → Informational
2xx → Success (200 OK, 201 Created)
3xx → Redirection
4xx → Client error (400 Bad Request, 401 Unauthorized, 404 Not Found)
5xx → Server error (500 Internal Server Error)

✅ Answer (Hinglish):

2xx → success
4xx → client ki mistake
5xx → server ki problem

🎯 Interview Tip: Always mention 200, 201, 400, 404, 500 (most important)

5. How do you validate whether the correct response is coming or not?

✅ Answer (English):
We validate response by checking:

Status code (e.g., 200 OK)
Response body (expected data)
Response time
Headers

Example (Postman test):

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

✅ Answer (Hinglish):
Check karte hain: Status code, Response data, Time, aur Headers.

🎯 Interview Tip: "Validation = Status + Body + Headers + Time"

1. Explain HTTP Status Codes (2xx, 3xx, 4xx, 5xx).

English:

2xx: Success (200 OK, 201 Created).
3xx: Redirection (301 Moved).
4xx: Client Error (400 Bad Request, 401 Unauthorized, 404 Not Found).
5xx: Server Error (500 Internal Server Error).

Hinglish: 2 series matlab kamyabi, 4 series client ki galti, aur 5 series server ki galti.

Module 5: SOAP vs REST Web Services

4. What are RESTful Web Services constraints?

English: Statelessness, Client-Server architecture, Cacheability, Layered system, and Uniform Interface.
Hinglish: REST ke kuch rules hain (Stateless etc.) jisse ye flexible aur scalable banti hain.

1. What is a web service?

English: A web service is an interface that allows different applications to communicate and exchange data over the internet.
Hinglish: Web service ek interface hota hai jo do different applications ke beech internet ke through data exchange karne deta hai.

2. What is the difference between SOAP and REST web services?

English / Hinglish:
- REST: Lightweight, supports JSON and XML, simpler and faster, no WSDL required.
- SOAP: XML-based, heavy, uses WSDL, complex but highly secure.

Hinglish: SOAP XML-based aur heavy hota hai, jabki REST lightweight hota hai aur JSON/XML support karta hai. SOAP WSDL use karta hai, REST nahi karta.

SOAP vs REST Message Structures

SOAP Message (XML Wrapper)

                                            <soap:Envelope>

                                              <soap:Header/>

                                              <soap:Body>

                                                <GetUser>

                                                  <id>101</id>

                                                </GetUser>

                                              </soap:Body>

                                            </soap:Envelope>

REST Response (Lightweight JSON)

                                            {

                                              "id": 101,

                                              "name": "Ram",

                                              "role": "QA Lead"

                                            }

Feature	REST	SOAP
Protocol vs Style	Architectural Style	Protocol
Data Format	JSON, XML, HTML, Text	Only XML
Performance	Fast, lightweight	Slow, heavy payload

3. What is WSDL and what does it contain?

English: WSDL stands for Web Services Description Language. It is an XML file describing the web service. It contains: Service name, Port and endpoint, Operations (methods), and Request/Response structural format.
Hinglish: Ye ek XML file hoti hai jo web service ke operations, request-response format aur endpoint batati hai.

6. Explain about your current project?

English: My current project is a web-based application. My role is to design test cases, execute manual testing, and automate regression test cases using Selenium with Java. I also perform API testing using Postman/SOAP UI and log defects in Jira.
Hinglish: Mera current project ek web-based application hai. Mera role test cases design karna, manual testing karna aur Selenium Java se regression test cases automate karna hai.

Frequently Asked Questions

Educational Overview: API TESTING

Welcome to Ram Technical Help. This interactive learning hub for api testing requires JavaScript to run live sandboxes, code execution, and interactive interview simulations.

Key Learning Objectives & Topics Covered

Core Theoretical Concepts: In-depth explanations of software testing methodologies, frameworks, and best practices.
Hands-On Practical Code Examples: Real-world code snippets in Java, Python, SQL, REST Assured, Selenium WebDriver, and Playwright.
Interview Screening Questions: Industry-vetted Q&A loops tailored for Manual QA, Automation Engineers, API Specialists, and SDETs.
Best Practices & Framework Design: Page Object Model (POM), Data-Driven Frameworks, CI/CD pipeline integration, and defect lifecycle management.

Recommended Next Steps for Students

To enable the full interactive experience, please turn on JavaScript in your browser settings. You can also explore our static curriculum, download interview PDFs, or watch video tutorials on our official YouTube channel.

Complete API Testing Guide: Postman, REST Assured, JSON Logic & Security