API Testing

An API request has a few moving parts: a method, a URL, headers, and sometimes a body. When a test fails, change one of those at a time. Otherwise a different status code will not tell you which change mattered.

Start with the smallest request

Try a GET without authentication if the endpoint allows it. Note the status code and response body. Then add the required headers and body. A 401 usually points you toward authentication; a 404 can mean the path is wrong, but can also be the API’s way of hiding a resource. Read the response before guessing.

Check what you actually sent

A JSON-looking string is not enough: the server may expect Content-Type: application/json, and malformed JSON can fail before application logic runs. Compare the request shown by your test tool with the API documentation. If you share a failing request, replace real tokens and personal data first.

Related tools

• API Mock Response Builder — Describe fields once and generate realistic mock JSON for an API response.
• gRPC Tester — Build grpcurl commands and test gRPC-Web endpoints from the browser.
• OpenAPI Viewer — Read an OpenAPI or Swagger document and list its operations, parameters and responses.
• Webhook Tester — Sign, verify and send a test webhook in the Stripe, GitHub or Shopify format.