Explain what is REST API?
It is a set of functions to which the developers performs requests and receive responses. In REST API interaction is made via HTTP protocol
REST – stands for Representational State Transfer, it is quickly becoming defacto standard for API creation.
API Testing Types?
API testing typically involves the following practices:
- Unit testing: To test the functionality of individual operation
- Functional testing: To test the functionality of broader scenarios by using a block of unit test results tested together
- Load testing: To test the functionality and performance under load
- Runtime/Error Detection: To monitor an application to identify problems such as exceptions and resource leaks
- Security testing: To ensure that the implementation of the API is secure from external threats
- UI testing: It is performed as part of end-to-end integration tests to make sure every aspect of the user interface functions as expected
- Interoperability and WS Compliance testing: Interoperability and WS Compliance Testing is a type of testing that applies to SOAP APIs. Interoperability between SOAP APIs is checked by ensuring conformance to the Web Services Interoperability profiles. WS-* compliance is tested to ensure standards such as WS-Addressing, WS-Discovery, WS-Federation, WS-Policy, WS-Security, and WS-Trust are properly implemented and utilized
- Penetration testing: To find vulnerabilities of an application from attackers
- Fuzz testing: To test the API by forcibly input into the system in order to attempt a forced crash
How to test API’s ?
To test the API’s you should follow the following steps
- Select the suite in which you want to add the API test case
- Choose test development mode
- Develop test cases for the desired API methods
- Configure application control parameters
- Configure test conditions
- Configure method validation
- Execute API test
- View test reports
- Filter API test cases
- Sequence API test cases
Mention what the main areas to be taken in consideration while writing API document ?
The key area to be considered when writing API documents are
Source of the content
Document plan or sketch
Delivery layout
Information required for each function in the document
Automatic document creation programs
In API document explain how to document each function ?What are the tools used for documentation?
- Description: Small description about what a function does
- Syntax: Syntax about the parameter of the code, the sequence in which they occur, required and optional elements etc.
- Parameters: Functions parameters
- Error Messages: Syntax of error messages
- Example Code: Small snippet of code
- Related Links: Related functions
What is API Authentication?
- Authentication is when an entity verifies the identity of a user. n other words, it proves that the clients trying to access a remote server are really who they say they are.
- Authorization is the next thing that happens after successful authentication. It is the approval that a certain client has the right to make a request. Simply, authorization is when an entity verifies that you have the right to access data or information on a given server.
- Since API is a profound entity with an external resource that has the capability of accepting and responding to protected resource requests by users and clients, they must be equipped to ensure that applications and clients trying to access data are authentic, so that they can proceed to authorized full access when identity is confirmed. The processes of certifying the identity of users trying to access resources on the server and this is what is known as API authentication.
Explain API framework?
API framework is self-explanatory. Values for test run and for holding the configurable parts, config file is used. Automated test cases must represent in “ parse-table” format within config file. When testing API, it is not necessary to test each API so the config file have some section whose all API are activated for that specific run.
How does the API Builder work?
API Builder is a PLSQL program consists of four SQL files
- For setting API parameters and starting the process one file is responsible
- Two files are created for temporary tables and Master package to create the outputted code
- Fourth file creates “spooled” output of the code into a file called “output_script_.sql”
What to test with an API?
The different categories of tests are:
Security testing checks how well the API is protected from malicious actors. It ensures that resources (data) are protected and only provided to authenticated or authorized clients.
Functional testing checks whether the endpoints are satisfying their requirements. Functional and security testing have more options when it comes to testing. Some of the things that are tested include:
- HTTP status code (i.e 200, 404, 405)
- data
- headers
Performance testing makes sure that an API can respond to requests of specific sizes, or can respond to clients quickly enough to satisfy system requirements. Performance testing may time how long it takes for a request to receive a response.
Connectivity determines if the API is responding and operational. If you are focusing on the connectivity of an API, you may execute a simple “ping” test to make sure that the server is responding.
Which are the most Common Methods of API Authentication?
Although there are several methods of API authentication, here are some of the most popular:
- HTTP Basic Authentication
- API Key Authentication
- OAuth Authentication
HTTP Basic Authentication
HTTP Basic Authentication is the simplest form of identification. This technique combines username and password to form a single value and passes it through a special HTTP header known as authorization where they are encoded with Base64. Therefore, when a client makes a request, the server checks the Authorization header and compares it to the credentials (username and password) it has stored. If they match, the server fulfills the client request, and if not, a special status code is sent back to inform clients that authentication has failed and their request denied.
API Key Authentication
API Key authentication is a technique that was invented to overcome the weaknesses of shared credentials which was a big problem in HTTP Basic authentication. The API key is usually a long series of numbers and letters that you either include in the request header or request URL. When the client authenticates the API key, the server stamps their identity and allows them to access data. API vendors might provide you with a public and private key depending on your needs, where the former can be used to limit users to certain functions, and the latter acts like a password that allows you full access.
Although this scheme is highly reliable, there some few tips that can make the API more secure:
- Make sure that you use HTTPS at all times.
- Keep it simple
- Avoid exposing information on URLs
- Use password hash
- Install some parameter validation
OAuth Authentication
Technically, Oauth is a technique that does both authentication and authorization. It is a form of API authentication that gives applications with the ability to communicate with API server to provide access. When a user logs into the system, it requests authentication in the form of a token. The client is required to forward the request to an authentication server, which either allows or rejects this it. OAuth authentication is fundamentally a more secure and powerful system than the rests, and it’s quickly becoming the number one choice for many clients and applications.
Explain API Security Best Practices?
A data breach leads to compromised information and a loss of trust from customers. A DDoS attack will disrupt an organization’s ability to function.
1. Assess the Data Value
The level of security necessary depends on the value of the data. APIs created for entertainment purposes do not require the same level of protection as client information. If an API is organizing information that is readily accessible on the web, there is little need for complex security solutions. However, if the API holds data such as a customer’s credit card information, it needs a high level of protection.
2. Examine API Vulnerabilities
People who want to steal information are constantly at work looking for ways to take advantage of vulnerabilities in the structure and design of an API. IT personnel must be informed about potential issues and recode the program accordingly. Some organizations employ a threat modeling process to look for vulnerabilities as well as potential attackers. Regular review will help developers find coding errors that might make the API subject to infiltration.
3. Encryption or Tokenization
- Data encryption is a standard safety practice for sharing information online. Unless it is an open-source project, most APIs require the user to have an encryption key that protects data as it travels. At the user’s endpoint, the browser uses the key to decrypt information. If a hacker can access the key, he or she can decipher the data.
- Tokenization is another API security strategy. This security technology began as an online payment safety solution. Unlike traditional encryption, data travels as a randomized placeholder or token with no direct relationship to the client. Even if a hacker intercepts the token, there is not a simple way to extract the information.
4. Using an API Gateway
As APIs grow in popularity, third-party programmers are developing tools to make these databases more secure and functional. An API gateway is a layer of structure and protection between users and API data. For companies with limited IT resources, a third-party gateway has the advantage of handling several API features. In addition to providing web API security through encryption and authorization, the gateway can also assist with billing, request rate limits, and analytics.
5. Placing Limits on Requests
REST API security involves more than protecting data. Cybercriminals can also cause problems by disrupting the API. To communicate with an API, an application makes a GET request to receive information or a POST request to add information. With no limits on access, a cybercriminal can carry out a nuisance attack by flooding an API with requests. If the database is trying to process thousands of requests from a single application, it will not be able to provide data to other users. Requests from valid users will time out and fail.
6. Establishing Authorization Levels
Unless the API is a fully open-source project, it is important to create access limits. In a typical arrangement, basic users can only retrieve data from the database and cannot modify information. The next level of access may allow a user to add information such as new accounts. It may require another authorization level to change entries in the API. Finally, an IT professional will have full access to modify the underlying code.
7. Data Validation
An API stores and releases data according to rules established by the developer. If there are no clear rules in place, it damages the functionality of the database. Hackers can disrupt the API by posting large entries that take up extra storage space. Invalid entries can cause corrupted files that throw error messages. For data entry, validation will include making sure that an entry is not empty and is in the proper format.
8. Security Analytics
While some cyberattacks are big and disruptive, others are subtle. If a cybercriminal is trying to steal information without the organization noticing, there may not be an obvious attack. API analytics is a helpful tool in REST API security. An organization can not only track the frequency of requests but also the location or origin of those requests. The IT professional responsible for a private API might set it up so that the system flags suspicious IP addresses or requires extra authentication.
CRUD – What is CRUD?
CRUD – again is:
Create
Read
Update
Delete
What are API Credentials?
API credentials can be defined as unique identifiers that must be added to code before you make a call via an API. Various APIs support different authorization credentials, but the typical APIs feature credentials options such as:
- Name
- API password
- Auth token
- API key
- Status
- Actions
Name: This is the first credential that you’ll be given for primary use. You can add more names for use by your partners or affiliates.
API password: This acts as your ID when you are requesting a token or when you want to make a call. It is automatically generated when you sign in, but you can create a new one using alphanumeric and no spaces.
Auth Token: For you to access private user data, you must send an Auth token along with the request. The app first sends a client ID, and possibly a secret word to obtain a token. Auth credentials can be generated for service accounts, web applications, or installed applications.
API keys: If a request doesn’t provide a token, it must offer an API key. The key is used to identify the project that is making the call and offers API access, reports, and quota.
Status: This credential denotes the membership level by defining whether it is active or inactive.
Actions: This allows you to either edit or deletes API credentials.
cURL – What is cURL?
- Curl is object-oriented programing software that is used to transfer data through a vast array of Internet Protocols for a given URL. It is a command-line utility that permits the transfer of files within the URL syntax. Curl is basically a client-side program which boasts commands that are designed in a way that they work to check connectivity to the URLs and facilitate data transfer.
- In the word cURL; ‘c’ stands for a client, while ‘URL’ indicates that curl works with URLs. This software supports various protocols including FTP, HTTPS, HTTPS, TELNET and SMT which makes it an ideal candidate for interacting with APIs.
- Curl can work on any platform and on any hardware that exists today
When to use cURL?
Since curl supports connection to remote systems over HTTP, HTTPS, TELNET and a vast array of other protocols, it is used when a script wants to access information from a remote system just like it was a local file/data stream. This is critical for developers who would wish to acquire data from a remote system and present it as they had it locally. Curl can be used in a terminal or command prompt, but you need to ensure that it is installed in the system you are using before you try to use it.
cURL Examples
1. Return the HTTP Headers of a URL Only
Curl -I https:// www.keycdn.com/
The -I option is used to instruct Curl to only fetch the HTTP header form a particular page or resource.
2. Making HTTP GET Request
Curl https:// www.keycdn.com/
This shows a basic curl command calling a GET request for a website URL.
3. To Bestow an Additional HTTP Header
The curl command can also be used to add a new HTTP Header to GET requests. All you need s to add the – H option followed by the header name and value in enclosed quotes.
curl -H "X-Header: Value" https://www.keycdn.com/
4. Continue a Download
Curl command can also be used to resume a download that was purposely stopped or interrupted. You simply add the -c to the Curl command in question and the system will resume downloading an item from where it stopped.
curl -C - -O https://cdn.keycdn.com/img/cdn-stats.png
What is a payload in API?
A payload in API is the actual data pack that is sent with the GET method in HTTP. It is the crucial information that you submit to the server when you are making an API request. The payload can be sent or received in various formats, including JSON. Usually, the payload is denoted using the “{}” in a query string.
Payload = “{}”
Example of Payloads
The payload is used in the context of message protocol to differentiate between the assisting and actual data in a query string. For instance, Let’s consider this JSON web service response.
{
"status": "OK",
"data":
{
"message": "Welcome, world!"
}
}
In the above example, the payload is the Welcome, World! Since it is the part of the query string that the user is interested in. The rest of the information is referred to as the overhead data. This is because it is only used to show the source or destination and display authenticity.
API Payload Formats
Basically, you’ll find three payload formats:
- Request payload format
- OK response payload format
- FAILED response payload format
API Request Payload Format
This request must have two parameters and a sub element:
- Interface Type
- Method name
- Parameters
Example:
{
"interfaceType": "Manual",
"methodName": "",
"parameters": {
}
}
API OK Response Payload Format
These features one parameter and one sub element:
- Response type
- Data. It may be zero or more parameters
Example:
{
"responseType": "OK",
"data": {
"someName1": "value",
"someName2": "value",
"someName3": "value"
}
}
API FAILED Response Payload Format
This also contains one parameter and one subelement:
- Response type
- Messages. May feature an array of zero or multiple error messages
Example:
{
"responseType": "FAILED",
"messages": [
{
"message": ""
},
{
"message": ""
},
{
"message": ""
}
]
}
Explain what is TestApi ?
TestApi is a library of utility and test APIs that enables testers and developers to create testing tools and automated tests for .NET and Win32 application. It provides a set of common test building blocks, types, data-structure and algorithms.
What is Input injection and what are different ways of doing it ?
Input Injection: It is the act of simulating user input, in several ways you can simulate user input.
- Direct Method Invocation
- Invocation using an accessibility interface
- Simulation using low-level input
- Simulation using a device driver
- Simulation using a robot
What are the main challenges of API testing?
The main challenges in API testing is
- Parameter Selection
- Parameter Combination
- Call sequencing
Other challenges with API Testing include:
- Updating schemas. Applications evolve and the structure of data can change
- Input parameters. Endpoints have the possibility to accept many combinations of values and data types. This can make it difficult to get the full test coverage that is desired.
What is API testing with runscope ?
Runscope is a web application that provides backend services and easy to use interface for testing APIs.
Explain what are the principles of API test design?
The principle for API test design are
- Setup : Create objects, start services, initialize data etc
- Execution: Steps to exercise API or scenario, also logging
- Verification: Oracles to evaluate execution outcome
- Reporting: Pass, failed or blocked
- Clean up: Pre-test state
What are the types of Bugs will API testing finds?
The types of Bugs, API will find
- Missing or duplicate functionality
- Fails to handle error conditions gracefully
- Stress
- Reliability
- Security
- Unused flags
- Not implemented errors
- Inconsistent error handling
- Performance
- Multi-threading issues
- Improper errors/messaging
- Security issues
- Multi-threaded issues
API Testing Best Practices:
- Test for the expected results
- Add stress to the system by sending a series of API load tests
- Group API test cases by test category
- Create test cases with all possible inputs combinations for complete test coverage
- Prioritize API function calls to make it easy to test
- Create tests to handle unforeseen problems
- Automate API testing wherever it is possible
What are the tools used for API test automation?
While testing Unit and API testing, both target source code, if an API method is using code based on .NET then the tool which is supporting should have .NET
Automation tools for API testing can be used are
- NUnit for .NET
- JUnit for Java
- HP UFT
- Soap UI
What are API Parameters?
API parameters are the variable parts of a resource. They determine the type of action you want to take on the resource. Each parameter has a name, value type ad optional description. Whenever you want to build a REST API, you have to decide which parameters should be present in the API endpoint. In simple terms, API parameters are options that can be passed with the endpoint to influence the response.
Types of REST API Parameters
There are four different parts of parameters which are often documented in separate groups on the same page. They include:
- Header parameters – These parameters are featured in the request header and are usually related to authorization.
- Query parameters – These are separated from the hierarchy parameters by a question mark
- Request body parameters – they are included in the request body and are used to send and receive data via the REST API.
- Template/Path parameters – Set off within curly braces, path parameters are placed within the path of an endpoint just before the query string, and they provide developers with an effective way to parameterize resources.
- Matrix parameters – They come in between the resource path and Query parameters and are separated from the hierarchy parameters by a semicolon.
- Plain Parameters – These are parameters which are defined in a request and are easily accessible in ReadyAPI but are omitted when the request is submitted.
Mention the steps for testing API ?
API testing steps:
- Select the test case that has to be fulfilled
- For API call develop a test case
- To meet the test case configure the API parameters
- Determine how will you validate a successful test
- Using programming language like PHP or .NET execute the API call
- Allow the API call to return the data to validate
What are the common protocols that are testing in API testing ?
DOM – What is the DOM?
- DOM stands for Document Object Model and refers to an interchange to web pages.
- Programmers apply DOM to generate documents and establish their structure by adding or deleting content from the said document. The DOM interacts with different kinds of documents such as the XML and HTML documents.
- Any element of substance or data found in HTML and XML documents can be approached, deleted or altered in any manner through the Document Object Model.
What is API Testing?
An API (Application Programming Interface) is a collection of software functions and procedures, called API calls, that can be executed by other software applications. Application developers code that links to existing APIs to make use of their functionality. This link is seamless and end-users of the application are generally unaware of using a separately developed API.
During testing, a test harness-an application that links the API and methodically exercises its functionality-is constructed to simulate the use of the API by end-user applications. The interesting problems for testers are:
1. Ensuring that the test harness varies parameters of the API calls in ways that verify functionality and expose failures. This includes assigning common parameter values as well as exploring boundary conditions.
2. Generating interesting parameter value combinations for calls with two or more parameters.
3. Determining the content under which an API call is made. This might include setting external environment conditions (files, peripheral devices, and so forth) and also internal stored data that affect the API.
4. Sequencing API calls to vary the order in which the functionality is exercised and to make the API produce useful results from successive calls.
What is meant by API Testing? Explain the API Testing process.
API testing is to make sure that the basic units of the software application function perfectly well. Reason why we perform API testing right from the initial stages of the product cycle to the final phase, ensuring that the product release in the market is error-free and worth every penny you invested. API testing process involves testing the methods of NET, JAVA, J2EE APIs for any valid, invalid, and inopportune inputs, plus testing the APIs on Application servers.
During testing, a test harness-an application that links the API and methodically exercises its functionality-is constructed to simulate the use of the API by end-user applications. The interesting problems for testers are:
1. Ensuring that the test harness varies parameters of the API calls in ways that verify functionality and expose failures. This includes assigning common parameter values as well as exploring boundary conditions.
2. Generating interesting parameter value combinations for calls with two or more parameters.
3. Determining the content under which an API call is made. This might include setting external environment conditions (files, peripheral devices, and so forth) and also internal stored data that affect the API.
4. Sequencing API calls to vary the order in which the functionality is exercised and to make the API produce useful results from successive calls.
During testing, a test harness-an application that links the API and methodically exercises its functionality-is constructed to simulate the use of the API by end-user applications. The interesting problems for testers are:
1. Ensuring that the test harness varies parameters of the API calls in ways that verify functionality and expose failures. This includes assigning common parameter values as well as exploring boundary conditions.
2. Generating interesting parameter value combinations for calls with two or more parameters.
3. Determining the content under which an API call is made. This might include setting external environment conditions (files, peripheral devices, and so forth) and also internal stored data that affect the API.
4. Sequencing API calls to vary the order in which the functionality is exercised and to make the API produce useful results from successive calls.
How tester can do API testing by manually ,could u please explain it.
API testing is specifically the testing of API functions. One should design the test cases even before the completion of API functions. The process typically includes the following steps.
- Path testing. Path testing is to check each independent path that a code module could possibly execute. It indicates the low bound value of the test cases that should be written.
- Equivalence partitioning and boundary value analysis. Whenever a number is required as an input of a API function, one should be alert for the need of EP and BVA.
- Coverage testing. Coverage testing is operated on a more detailed level. There are several aspects of a API functions that requires the check of percentage of being cover. Statement coverage checks the percentage of statements in a API that are covered by test cases. Branch coverage is to make sure each predicate in a API is checked for both true and false condition. Condition coverage is to pass a predetermined input for every condition of every predicate in a API and check if it can get a predetermined output. For a very large code block, only 50% of condition coverage can be achieved.
How do you test a backend API?
How you approach testing an API depends on a lot of things. Will the API be a public API that will be consumed by some external people/systems, or is it a part of a larger product’s infrastructure? API is a general term that is sometimes used to describe anything from a COM interface, to a DLL or JAR you can reference, to a REST web service. Different approaches can be applied to testing these different things.
Often, if the API is part of your infrastructure you can test it pretty thoroughly through unit testing and the use of the product that consumes it.
If it is an externally consumable API then you need to be much more thorough because people could use it in different ways than you might expect and send data in much different formats, etc. It also usually needs to make sense, be intuitive and be well documented if it is externally consumable. You would also need to be more cautious about what is private and public, which may not be as important for an API that is only used by a single product.
Testing an API nearly always requires you to create some sort of consumer for testing purposes. You have to create an application to interact with the API. The application is usually very simple and driven by automated test cases and not manual user interaction, although I have seen cases where people created a complex GUI app for testing purposes, and cases where the testing was still mostly manual through exercising that app.
If the API has dependencies, you may choose to mock those dependencies out so you can more thoroughly test all of those interactions and hit all of the positive and negative code paths. For instance, if the API interacts with a database and has the ability to create, modify and delete data you may want to mock the interaction with the database to more easily test cases such as deleting a record when it does not exist, or when it is the final record, or when it is unable to be deleted because of dependencies or even when the connection to the database is unavailable – you can then see how your API would handle these situations.
What is an API?
API stands for Application Programming Interface, which specifies how one component should interact with the other. It consists of a set of routines, protocols and tools for building the software applications.
What is an API Testing?
The API Testing is performed for the system, which has a collection of API that ought to be tested. During Testing, a test of following things is looked at.
- Exploring boundary conditions and ensuring that the test harness varies parameters of the API calls in ways that verify functionality and expose failures.
- Generating more value added parameter combinations to verify the calls with two or more parameters.
- Verifying the behavior of the API which is considering the external environment conditions such as files, peripheral devices, and so forth.
- Verifying the Sequence of API calls and check if the API’s produce useful results from successive calls.
Common Tests performed on API’s
- Return Value based on input condition – The return value from the API’s are checked based on the input condition.
- Verify if the API’s does not return anything.
- Verify if the API triggers some other event or calls another API. The Events output should be tracked and verified.
- Verify if the API is updating any data structure.
What is an API?
API is an acronym for Application Programming Interface.
It enables communication and data exchange between two separate software systems. A software system implementing an API contains functions/sub-routines which can be executed by another software system.
What is API testing?
API testing is entirely different from GUI testing and mainly concentrates on the business logic layer of the software architecture. This testing won’t concentrate on the look and feel of an application.
Instead of using standard user inputs(keyboard) and outputs, in API Testing, you use software to send calls to the API, get output, and note down the system’s response.
API Testing requires an application to interact with API. In order to test an API, you will need to
Difference API and Unit Testing?
API testing
API is owned by QA team
API is mostly black box testing
Full functionality of the system is considered in API testing as it will be used by the end-user (external developers who will use your API )
API test are often run after the build is ready and authors do not have access to the source code
UNIT testing
Unit testing is owned by development team
Unit testing is white box testing
Unit testing is done to verify whether each unit in isolation performs as expected or not
For each of their module the developers are expected to build unit tests for each of their code modules and have to ensure that each module pass unit test before the code is included in a build
Use Testing Tool to drive the API
Write your own code to test the API
The API Testing is performed for the system, which has a collection of API that ought to be tested. During Testing, a test of following things is looked at.
- Exploring boundary conditions and ensuring that the test harness varies parameters of the API calls in ways that verify functionality and expose failures.
- Generating more value added parameter combinations to verify the calls with two or more parameters.
- Verifying the behavior of the API which is considering the external environment conditions such as files, peripheral devices, and so forth.
- Verifying the Sequence of API calls and check if the API’s produce useful results from successive calls.
