Testing Web APIs

by Mark Winteringham

Overview

Ensure your web APIs are consistent and bug-free by implementing an automated testing process.

In Testing Web APIs you will:

Design and implement a web API testing strategy
Set up a test automation suite
Learn contract testing with Pact
Facilitate collaborative discussions to test web API designs
Perform exploratory tests
Experiment safely in a downloadable API sandbox environment

Testing Web APIs teaches you to plan and implement the perfect testing strategy for your web APIs. In it, you’ll explore dozens of different testing activities to help you develop a custom testing regime for your projects. This practical book demystifies abstract strategic concepts by applying them to common API testing scenarios, revealing how these complex ideas work in the real world. You’ll learn to take a risk-driven approach to API testing, and build a strategy that goes beyond the basics of code and requirements coverage. Your whole team will soon be involved in ensuring quality!

Purchase of the print book includes a free eBook in PDF, Kindle, and ePub formats from Manning Publications.

About the technology
Web APIs are the public face of your application, and they need to be perfect. Implementing an automated testing program is the best way to ensure that your web APIs are production ready.

About the book
Testing Web APIs is a unique and practical guide, from the initial design of your testing suite through techniques for documentation, implementation, and delivery of consistently excellent APIs. You’ll see a wide range of testing techniques, from exploratory to live testing of production code, and how to save time with automation using industry-standard tools. This book helps take the hassle out of API testing.

What's inside

Design and implement a web API testing strategy
Set up a test automation suite
Contract testing with Pact
Hands-on practice in the downloadable API sandbox

About the reader
For dedicated software QA and testers, or experienced developers. Examples in Java.

About the author
Mark Winteringham is the OpsBoss at Ministry of Testing, where he teaches many aspects of software testing.

Table of Contents
PART 1 THE VALUE OF WEB API TESTING
1 Why and how we test web APIs
2 Beginning our testing journey
3 Quality and risk
PART 2 BEGINNING OUR TEST STRATEGY
4 Testing API designs
5 Exploratory testing APIs
6 Automating web API tests
7 Establishing and implementing a testing strategy
PART 3 EXPANDING OUR TEST STRATEGY
8 Advanced web API automation
9 Contract testing
10 Performance testing
11 Security testing
12 Testing in production

Product Details

ISBN-13:	9781617299537
Publisher:	Manning
Publication date:	12/06/2022
Pages:	264
Product dimensions:	7.38(w) x 9.25(h) x 0.20(d)

About the Author

Mark Winteringham is the DojoBoss at Ministry of Testing. He teaches many aspects of software testing, and he supports and curates testing training from others in the testing community. He is the co-founder of Automation in Testing and Ministry of Testing Essentials training pathways.

Table of Contents

Foreword xii

Preface xiv

Acknowledgments xv

About this book xvii

About the author xxii

About the cover illustration xxiii

Part 1 The value of web API testing 1

1 Why and how we test web APIs 3

1.1 What's going on in your web APIs? 3

Complexity within web APIs 4

Complexity across many web APIs 5

1.2 How does testing help us? 6

Imagination 7

Implementation 7

The value of testing 8

Being strategic with API testing 8

2 Beginning our testing journey 12

2.1 Introducing our product 13

Introducing our sandbox API 13

2.2 Familiarizing ourselves with restful-booker-platform 14

Researching the product 15

Researching beyond the product 20

2.3 Capturing our understanding 23

The power of models 23

Building our own models 24

2.4 Congratulations-you're testing! 27

3 Quality and risk 28

3.1 Defining quality 29

Quality characteristics 30

Getting to know our users 31

Setting quality goals for our strategy 32

3.2 Identify risks to quality 34

Learning to identify risk 34

Headline game 35

Oblique testing 35

RiskStorming 36

3.3 A strategy's first steps 39

Picking the right approach for testing a risk 40

Part 2 Beginning our test strategy 43

4 Testing API designs 45

4.1 How do we test API designs? 47

Tools for questioning 48

Expanding your API design-testing techniques and tools 53

4.2 Using API documentation tools to test designs 56

Documenting APIs with Swagger/OpenAPI 3 56

Beyond documentation 63

4.3 Encouraging teams to test API designs 64

Getting buy-in and initiating opportunities to test API designs 64

Taking advantage of existing sessions 64

Establishing your own sessions 65

4.4 Testing API designs as part of a testing strategy 66

5 Exploratory testing APIs 68

5.1 The value of exploratory testing 69

The testing cycle in exploratory testing 69

5.2 Planning to explore 70

Generating charters 71

Charters and exploratory testing sessions 73

Organizing our exploratory testing 73

5.3 Exploratory testing: A case study 74

Beginning the session 75

Knowing when something isn't right 77

Coming up with ideas for testing 79

Using tools 81

Note-taking 84

Knowing when to stop 86

Running your own exploratory testing session 88

5.4 Sharing your discoveries 88

5.5 Exploratory testing as part of a strategy 89

6 Automating web API tests 92

6.1 Getting value from automation 93

The illusion of automation 93

Automation as change detection 95

Letting risk be our guide 96

6.2 Setting up a Web API automation tool 97

Dependencies 97

Structuring our framework 99

6.3 Creating automated API checks 100

Automated check 1: A GET request 100

Automated check 2: A POST request 102

Automated check 3: Combining requests 107

Running your automated tests as integration tests 113

6.4 Utilizing automation in our strategy 114

7 Establishing and implementing a testing strategy 116

7.1 Establishing a strategy for our context 117

Identifying what's a priority 118

Different strategies for different contexts 120

7.2 Turning a testing strategy into a testing plan 121

Understanding your context's testability 122

Organizing and documenting a plan 126

Executing and reflecting on a plan 127

Evolving our strategy 129

Part 3 Expanding our test strategy 131

8 Advanced web API automation 133

8.1 Acceptance test-driven development 134

Setting up an automated acceptance testing framework 135

Creating our failing automated check 136

Getting our automated check to pass 140

Beware of traps 140

8.2 Web API mocking 141

Getting set up 142

Building our mocked check 144

8.3 Running as part of a pipeline 146

Integrated with codebase 146

Separate to codebase 148

9 Contract testing 151

9.1 What contract testing is and how can it help 152

9.2 Setting up a contract testing framework 154

Introducing Pact 154

9.3 Building a consumer contract test 155

Adding Pact to our class 156

Building the consumer check 156

Setting up and publishing to a Pact Broker 159

9.4 Building a provider contract test 161

Building the provider contract test 161

Testing out a change 163

9.5 Contract testing as part of a testing strategy 164

10 Performance testing 166

10.1 Planning a performance test 167

Types of performance tests 167

Types of measurements for performance tests 169

Establishing performance testing goals and key performance indicators (KPIs) 169

Creating user flows 172

10.2 Implementing a performance test 175

Setting our performance testing tool 175

Building our performance test script 177

10.3 Executing and measuring a performance test 185

Preparing and executing our performance test 185

Analyzing results 187

10.4 Setting performance testing expectations 190

11 Security testing 193

11.1 Working with threat models 194

Creating a model 194

Discovering threats with STRIDE 196

Creating threat trees 199

Mitigating threats 201

11.2 Applying a security mindset to our testing 202

Security testing in testing API design sessions 202

Exploratory security testing 203

Automation and security testing 207

11.3 Security testing as part of a strategy 210

12 Testing in production 212

12.1 Planning out testing in production 213

What to track 213

Service-level objectives 214

Service-level agreements 215

Service-level indicators 216

What to save 217

12.2 Setting up testing in production 219

Setting up a Honeycomb account 219

Adding Honeycomb to APIs 219

Advanced querying 221

Building SLO triggers 224

12.3 Taking testing in production further 224

Testing with synthetic users 225

Testing hypotheses 226

12.4 Expanding your strategy by testing in production 227

Appendix Installing the sandbox API platform 230

Index 233