# Ask Me Anything: API Testing **URL:** \ **Category:** šŸ—“ļø Events\ **Tags:** ask-me-anything, api-testing\ **Created:** [12 May 2020 19:05 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408 "2020-05-12T19:05:06Z")\ **Posts on this page:** 14\ **Page:** 2
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [13 May 2020 18:21 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/25 "2020-05-13T18:21:13Z")
> [@heather\_reid](#): > > We as a team adopting API testing with a use of mocha and Mountebank. Iā€™m beginner API tester, what would be the best approach to tackle this. What are the pros and cons of such framework? What tool would you recommend for contract testing? Mountebank is used for service virtualization, so not really testing all services completely - assuming youā€™re using something like supertest with mocha to connect to the APIsā€¦ Pros are youā€™re able to test the various APIs in isolation Cons are if you rely on Mountebank too much, you might miss critical issues. Itā€™s great to test in isolation but you need to see how theyā€™re working together to get the best picture of your APIs health from these tests. For contract testing, PACT is an industry standard I think, and is supported in multiple languages. ---
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [13 May 2020 18:22 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/26 "2020-05-13T18:22:16Z")
> [@heather\_reid](#): > > We are moving from REST APIs to gRPC APIs. Is there a suggested best tool for testing gRPC? I have never tested gRPC but Iā€™m sure the community has some great ideas! ---
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [14 May 2020 18:21 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/28 "2020-05-14T18:21:20Z")
> [@heather\_reid](#): > > Any tips about mocking proto message? Iā€™m not familiar with proto messages, so Iā€™m not sure how mocking them would differ from mocking otherwise. Maybe the community can help? ---
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [14 May 2020 18:26 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/30 "2020-05-14T18:26:51Z")
> [@heather\_reid](#): > > Hi, which is the best tool to test APIs that are in sequence, Ex, API 1 out is the input of API 2 and API 3. It is better to include each API test into a pipeline by CI or there is a tool that could perform it all alone? I would approach this the same way I would testing microservices which act the same way in some cases. Test the APIs in isolation, mocking what needs to be mocked. Then testing user or process flows without mocking, to ensure the connections work still etc. As for the tool to run the tests, that depends on what tool youā€™re using to write them. They can be written in any language, really, and lots of tools exist to make that easier for folks that donā€™t do much coding. For the non-coded tests, that depends on the tool (setting up ā€œplaylistsā€ of tests etc). ---
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [14 May 2020 18:29 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/31 "2020-05-14T18:29:13Z")
> [@heather\_reid](#): > > What do you think of checking that a json (or xml) schema received is valid? Is it a good strategy to start with? If you have consumers of your api, this is very important to check (and hopefully have consumer-driven contract tests that check that). Otherwise, the schema may not matter as much as the data. For instance - does it matter that what used to be a String value is now returned as a DateTime value? Maybe not, as long as the data is the same. ---
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [14 May 2020 18:30 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/32 "2020-05-14T18:30:58Z")
> [@heather\_reid](#): > > Do you test REST specific post/get/delete/put for some uri? Iā€™m not sure the question here - basic API testing would be testing each available method (GET/POST/PUT/DELETE/PATCH/etc) for a given endpoint, yes. ---
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [14 May 2020 18:32 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/33 "2020-05-14T18:32:43Z")
> [@heather\_reid](#): > > Do you check headers in api testing? It depends on if anything specific is being sent in headers. If Iā€™m not expecting anything to be sent in a header, I generally ignore them. But if itā€™s something the API should be setting, it should be tested. ---
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [14 May 2020 18:35 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/34 "2020-05-14T18:35:34Z")
> [@heather\_reid](#): > > Which of these tools do you like for API testing: retrofit2, Apache Http Client, RestAssure, Other? I have never used any of those tools šŸ˜• the tools I use and like are: - Postman (I use this for manual testing - ad-hoc and exploratory testing) - Swagger/OpenAPI (ad-hoc testing) - RestSharp with C# and NUnit or XUnit (automation) - Supertest with JavaScript and Mocha (automation) ---
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [14 May 2020 18:36 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/35 "2020-05-14T18:36:53Z")
> [@heather\_reid](#): > > Can a well defined API-testsuite reduce or remove the need for unit tests in a distributed system with well-defined microservices. No. Unit tests and API tests cover different things. I think unit tests would still be needed to catch things before you get to the API level. You want to make sure the unit itself works well before integrating with others (inside its own codebase or another api) ---
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [14 May 2020 18:40 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/36 "2020-05-14T18:40:28Z")
> [@heather\_reid](#): > > Can we rely 100% on API tests before releasing a backend application? If yes, how can we make sure that nothing will break in the frontend application? You canā€™t rely 100% on any type of tests at any one level (even if you could somehow get 100% test coverage) - itā€™s just a fact of life there will be bugs if itā€™s software! API tests will not tell you if the javascript on the frontend is working, for example. Even if you had somehow 100% API test coverage, you could still have issues with the frontend because itā€™s different code, and it interacts with things in various ways. ---
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [14 May 2020 18:41 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/37 "2020-05-14T18:41:18Z")
> [@heather\_reid](#): > > can we do security or performance tests using API? Absolutely and you should! You can do basically all of the same types of testing against an API as you would any other kind of app - even usability testing! If there are consumers of your API, you can do usability testing to make sure itā€™s easy to use and understandable. > [@heather\_reid](#): > > Do you check error texts for 400/401/403/etc? And try to avoid 500 answers from the backend. Yes, as we have consumers of our API thatā€™s kind of part of our usability testing (that I mentioned above). If something goes wrong, we want them to know how to fix it. So if itā€™s a 400 (which is Bad Request) we want them to know how to fix the request so itā€™ll work right next time. Definitely try to avoid as many 500s as possible (those can crash things!). So testing for those ā€œunhappy pathā€ scenarios is a great way to find the accidental 500s, which are just error scenarios not specifically handled by the code. > [@heather\_reid](#): > > Why different requests are there? Other than GET and POST. There maybe more (need to google it!) but the ones that are most tested, by me at least, are: - GET - POST - PUT - DELETE - PATCH ---
**Author:** ![g33klady](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/g33klady/32/734_2.png) [@g33klady](https://club.ministryoftesting.com/u/g33klady)\ **Post date:** [15 May 2020 19:01 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/39 "2020-05-15T19:01:38Z")
> [@heather\_reid](#): > > Do you have a pyramid ( kind of ) for testing API based on your personal experience? I donā€™t really think of my approach as a pyramid, just basically the same as a UI testing approach. I find my testing priorities based on risk, use my oracles and heuristics to do my testing, etc. > [@heather\_reid](#): > > What does containerization mean for API Testing? Containerization doesnā€™t change much in my experience. The only difference I see is that I can run the APIs locally more easily with containerization > [@heather\_reid](#): > > - What is a soap api? Thereā€™s great info on what SOAP is and the difference with REST here: [SOAP vs REST APIs: Which Is Right For You? | SoapUI](https://www.soapui.org/learn/api/soap-vs-rest-api/) > [@heather\_reid](#): > > - Beginnerā€™s question: key factors to prioritise when you have 200+ end points? Like any other large application, do a risk assessment against each endpoint: - How often itā€™s used - how often itā€™s broken - how critical it is to business - how critical it is to consumers of the API (websites and other APIs alike) Use level of risk to determine priority > [@heather\_reid](#): > > - Do you use a lot of mock data when automating to validate against? When is it good time to mock or not? This varies depending on what the API has as far as data. Currently, I create new data objects to test with every time for the tests that require data in a request/response etc. Itā€™s not really ā€œmockā€ data, itā€™s just test data > [@heather\_reid](#): > > - Do you have any suggestions on where to go to get API training resources? The Dojo has some great courses (answered above) and Iā€™m coming out with a Dojo course soon on automating API checks with RestSharp! ---
**Author:** ![jamesespie](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/jamesespie/32/8536_2.png) [@jamesespie](https://club.ministryoftesting.com/u/jamesespie)\ **Post date:** [24 May 2020 06:34 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/40 "2020-05-24T06:34:06Z")
Hey! Iā€™m so sorry I missed the notification for this. If itā€™s of any use: When I was working on GraphQL, our frontend was built directly off those GraphQL queries. So, we structured our tests to map exactly to the queries / mutations that were being called by the frontend. Thatā€™s what made the most sense in our context - if you start going down the road of every different possible query / mutation, I think the possibilities start to become endless! ---
**Author:** ![melissafisher](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/melissafisher/32/8020_2.png) [@melissafisher](https://club.ministryoftesting.com/u/melissafisher)\ **Post date:** [26 June 2022 19:02 UTC](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408/41 "2022-06-26T19:02:30Z")
Great ask me anything @g33klady ! Enjoyed learning from you. [Previous page](https://club.ministryoftesting.com/t/ask-me-anything-api-testing/38408.md?page=1)