Why this matters
Apps and websites get their data from servers through APIs. Testing the API directly finds bugs the screen hides, such as a server that accepts a negative amount or confirms the same payment twice. API testing appears in several adverts for testing roles, including remote ones, and Postman is a common tool for it.
How an API request works
When an app shows your balance, it sends a request to the server and receives a response. A request has:
- A method: what you want to do. GET reads data, POST creates something, PUT or PATCH changes something, DELETE removes something.
- A URL: the address, such as
https://api.example.com/accounts/42. - Headers: extra information, often including a token that proves who you are.
- A body: for POST and PUT, the data you send, usually written in JSON.
The response has a status code and usually a JSON body. Status codes you should know:
- 200 OK, and 201 Created
- Bad request: the data sent was wrong