# What to test when writing automated tests for graphql api? **URL:** \ **Category:** Discussions\ **Tags:** tools, automation, api-testing\ **Created:** [10 April 2023 07:27 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698 "2023-04-10T07:27:36Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![abhishek\_k](https://avatars.discourse-cdn.com/v4/letter/a/f05b48/32.png) [@abhishek\_k](https://club.ministryoftesting.com/u/abhishek_k)\ **Post date:** [10 April 2023 07:27 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/1 "2023-04-10T07:27:36Z")
I understand the basic of how graphql work, like we have query and mutation as get and post type request. and in body we have to pass either query or mutation along with it’s variables and auth token. However as this is bit different from REST, there are few things I’m not sure how to begin with. - 1. What actually is testable. 2. How to form scenarios. 3. Which tool is best to automate? (Currently I’m trying to automated using Rest Assured) 4. With Rest assured I have been trying to pass query and variables separately but it’s not working. I’m getting {“errors”:[{“message”:"Invalid Syntax : offending token '"query. ---
**Author:** ![restertest](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/restertest/32/9342_2.png) [@restertest](https://club.ministryoftesting.com/u/restertest)\ **Post date:** [10 April 2023 07:44 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/2 "2023-04-10T07:44:42Z")
In general it should not differ a lot from the tests made for a Rest API, with the particularities of Graphql of course ( Query, Fragment, Methods etc). There is this older article that I think would help. Have a look > **[Testing GraphQL API - TestProject](https://blog.testproject.io/2020/06/23/testing-graphql-api/)** > > The Definitive Guide to Testing GraphQL API: In this 2nd chapter, we will learn how to test GraphQL and use popular tools: TestProject, Postman, etc! ---
**Author:** ![mirza](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/mirza/32/9965_2.png) [@mirza](https://club.ministryoftesting.com/u/mirza)\ **Post date:** [10 April 2023 08:57 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/3 "2023-04-10T08:57:21Z")
You can mostly focus on testing the schema, but more importantly, focus on asserting what the response body is returning. Validating response codes is not needed, since mostly you get back 200 anyway. Also, try to get creative when testing, for queries (and mutation) that accept parameters see what happens when you send something that isn’t supported, try nesting a lot of fields in a query to see if it has a negative impact on performance. Postman is pretty easy to set up for GraphQL testing, I used it to explore GraphQL APIs: > **[Querying with GraphQL | Postman Learning Center](https://learning.postman.com/docs/sending-requests/graphql/graphql)** > > Querying with GraphQL: documentation for Postman, the collaboration platform for API development. Create better APIs—faster. I haven’t used it in a job for the last two years, but I remember that Bas Dijkstra (he’s one of the top experts in API testing today) had a tutorial on how to test GraphQL using Rest-assured: > **[Writing Tests for GraphQL APIs using REST Assured](https://applitools.com/blog/writing-tests-graphql-apis-rest-assured/)** > > REST has been the de facto standard for APIs for a while now, replacing the relatively cumbersome and XML-only SOAP-based APIs with an architecture that ---
**Author:** ![sebastian\_solidwork](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/sebastian_solidwork/32/11076_2.png) [@sebastian\_solidwork](https://club.ministryoftesting.com/u/sebastian_solidwork)\ **Post date:** [10 April 2023 10:32 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/4 "2023-04-10T10:32:00Z")
Keep in mind that you not just can test **the** API (e.g. are paramater validated, is something returned). But also **by** the API the underlying system as whole (e.g. is the response correct in relation to the use case, what problems can you find in the processing). An API is seldom an isolated function on its own, but a gate, like the UI, to the whole application. ---
**Author:** ![okdashcam](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/okdashcam/32/11418_2.png) [@okdashcam](https://club.ministryoftesting.com/u/okdashcam)\ **Post date:** [11 April 2023 03:01 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/5 "2023-04-11T03:01:01Z")
> [@mirza](#): > > Validating response codes is not needed, since mostly you get back 200 anyway. I agree, but it depends on what you’re asked to test. If you see requests that return 200 but the body of the response says “error” that’s a bug! ---
**Author:** ![globalworming](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/globalworming/32/11346_2.png) [@globalworming](https://club.ministryoftesting.com/u/globalworming)\ **Post date:** [11 April 2023 11:30 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/6 "2023-04-11T11:30:06Z")
> [@okdashcam](#): > > If you see requests that return 200 but the body of the response says “error” that’s a bug! that’s actually expected with graphql and no bug. ---
**Author:** ![mirza](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/mirza/32/9965_2.png) [@mirza](https://club.ministryoftesting.com/u/mirza)\ **Post date:** [11 April 2023 12:36 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/7 "2023-04-11T12:36:08Z")
Yes, that’s why it’s important to pay special attention to the response payload as the status codes aren’t much help, as they are with REST APIs. ---
**Author:** ![abhishek\_k](https://avatars.discourse-cdn.com/v4/letter/a/f05b48/32.png) [@abhishek\_k](https://club.ministryoftesting.com/u/abhishek_k)\ **Post date:** [11 April 2023 17:55 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/8 "2023-04-11T17:55:56Z")
so far from what I have learned I believe it’s a bug. However I also got to know that developers can customise return code with error messages gracefully handled. ---
**Author:** ![okdashcam](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/okdashcam/32/11418_2.png) [@okdashcam](https://club.ministryoftesting.com/u/okdashcam)\ **Post date:** [11 April 2023 19:21 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/9 "2023-04-11T19:21:17Z")
Oh I was talking about RESTful API specifically! If you send 200 and error that’s not normal. I didn’t know GraphQL sent 200 even for errors! P.S. btw I love Worms:armageddon do you still play? ---
**Author:** ![globalworming](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/globalworming/32/11346_2.png) [@globalworming](https://club.ministryoftesting.com/u/globalworming)\ **Post date:** [12 April 2023 07:10 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/10 "2023-04-12T07:10:31Z")
it’s kinda undefined because graphql is supposed to be independent from the transport layer. You could for example have client and server communicate via websocket. Graphql still works the same but you don’t have any POSTs and http status codes. As API designer, you can still decide do accompany errors with specific status codes, like when you return 401 when missing authentication. you can argue that this is before involving graphql. If you go by what graphql defines, then errors are in the response message, and http status codes are not sufficient to check for “success”. ---
**Author:** ![globalworming](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/globalworming/32/11346_2.png) [@globalworming](https://club.ministryoftesting.com/u/globalworming)\ **Post date:** [12 April 2023 07:11 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/11 "2023-04-12T07:11:47Z")
> [@okdashcam](#): > > I love Worms:armageddon do you still play? last time like 15 years ago. but my son is getting older, so maybe I play again in a few years 🙂 ---
**Author:** ![mirza](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/mirza/32/9965_2.png) [@mirza](https://club.ministryoftesting.com/u/mirza)\ **Post date:** [12 April 2023 21:02 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/12 "2023-04-12T21:02:10Z")
I used to play that with my sister when we were both a lot younger, I always loved the sounds those worms make when they “talk” 😆 ---
**Author:** ![system](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/system/32/14378_2.png) [@system](https://club.ministryoftesting.com/u/system)\ **Post date:** [9 April 2025 07:28 UTC](https://club.ministryoftesting.com/t/what-to-test-when-writing-automated-tests-for-graphql-api/66698/13 "2025-04-09T07:28:25Z")
This topic was automatically closed after 730 days. New replies are no longer allowed.