book

API Testing and Development with Postman

by Dave Westerveld

May 2021

Beginner to intermediate

340 pages

8h 12m

English

Packt Publishing

Read now

Unlock full access

ContributorsAbout the authorAbout the reviewer
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesDownload the color imagesConventions usedGet in touchReviews
What is an API?Types of API callsInstalling PostmanStarting PostmanSetting up a request in PostmanThe structure of an API requestAPI endpointsAPI actionsAPI parametersAPI headersAPI bodyAPI responseLearning by doing – making API callsConsiderations for API testingBeginning with explorationLooking for business problemsTrying weird thingsDifferent types of APIsREST APIsSOAP APIsGraphQL APIsGraphQL API exampleSummary
Technical requirementsStart with the purposeFiguring out the purposeCreating usable APIsUsable API structureGood error messagesDocument your APIDocumenting with PostmanGood practices for API documentationRESTful API Modeling LanguageDesigning an APICase study – Designing an e-commerce API Modeling an existing API designSummary
Technical requirementsWhat are API specifications?API specification terminologyTypes of API specificationsCreating OASesParts of an OASDefining API schemaUsing API specifications in PostmanCreating mocks from an OASCreating tests from an OASSummary
Technical requirementsExploring and automatingExercise – considerations for good API test automationWriting good automationTypes of API testsOrganizing and structuring testsCreating the test structureOrganizing the testsCreating maintainable testsUsing loggingTest reportsSummary
Understanding API securityAuthorization in APIsAuthentication in APIsAPI security in PostmanGetting started with authorization in PostmanUsing Basic AuthUsing Bearer TokensUsing API keysUsing AWS SignatureUsing OAuth Using Digest auth and Hawk authenticationUsing NTLM authenticationUsing Akamai EdgeGridSecurity testing with PostmanFuzzingCommand injectionAuthorization testingIntegrating with Burp SuiteSummary
Technical requirementsChecking API responsesChecking the status code in a responseChecking the body of a responseChecking headersCustom assertion objects in PostmanCreating your own testsCreating folder and collection testsCleaning up after testsSetting up pre-request scriptsUsing variables in pre-request scriptsPassing data between testsBuilding request workflowsUsing environments in PostmanManaging environment variablesEditing environment variablesSummary

Technical requirementsDefining data-driven testingSetting up data-driven inputsThinking about the outputs for data-driven testsCreating a data-driven test in PostmanCreating the data inputAdding a testComparing responses to data from a fileChallenge – data-driven testing with multiple APIs Challenge setupChallenge hintsSummary
Technical requirementsGetting Newman set upInstalling NewmanRunning NewmanUnderstanding Newman run optionsUsing environments in NewmanRunning data-driven tests in NewmanOther Newman optionsReporting on tests in NewmanUsing Newman's built-in reporters Using external reportersCreating your own reporterIntegrating Newman into CI buildsGeneral principles for using Newman in CI buildsExample of using Travis CISummary
Technical requirements Setting up a monitor in PostmanCreating a monitorUsing additional monitor settingsAdding tests to a monitorViewing monitor resultsCleaning up the monitorsSummary
Technical requirementsFinding bugs in an APISetting up a local API for testingTesting the APIFinding bugs in the APIResetting the serviceExample bugAutomating API testsReviewing API automation ideasSetting up a collection in PostmanCreating the testsAn example of automated API testsSetting up a collection in PostmanCreating the testsSharing your workSharing a collection in PostmanSummary
Technical requirementsCreating an API specificationStarting the fileDefining the endpointsDefining parametersAdding additional responsesDescribing request bodiesUsing examplesAdding the API to PostmanContract testingUnderstanding API versioningThinking through when to create a new API versionSummary
Technical requirementsDifferent approaches to testing with mocksSetting up a mock serverCreating a mock server from a specification fileCreating a mock server from a collectionCreating a new mock server from scratchCreating good mock responsesUsing default examplesCreating custom examplesUsing dynamic variables in examplesResponding based on parametersUnderstanding example matchingUsing mock serversDeveloping against a mock serverContinuous planning with a mock serverTesting with a mock serverSummary
Understanding contract testingWhat is contract testing?How to use contract testingWho creates the contracts?Setting up contract tests in PostmanCreating a contract testing collectionAdding tests to a contract test collectionRunning and fixing contract testsFixing contract test failuresSharing contract testsSummary
Technical requirementsDesigning an APISetting up the challengeChallenge – Design a usable APISolution – Design a usable APIChallenge 2 – Create an API specification fileSolution 2 – Create an API specification fileSetting up the API in PostmanChallenge – Add an API and mock server in PostmanSolution – Add an API and mock server in PostmanCreating tests and documentation for the APIChallenge – Add tests to the APISolution – Add tests to the APISharing what you have doneSummary
Other Books You May EnjoyPackt is searching for authors like youLeave a review - let other readers know what you think

Content preview from API Testing and Development with Postman

Chapter 5: Understanding Authorization Options

In 2017, Equifax, a large credit reporting agency, announced that they had been hacked. Data from 147 million of their users had been stolen. Years of lawsuits and fines followed and by the time everything had been paid out, the hack cost Equifax more than 1.7 billion dollars.

Although this is one of the most expensive hacks in history, it is far from the only one. Many thousands of companies have been hacked and lost data. The cost of these hacks might range from dollar amounts that end in billions, to those that are "only" in the millions, but the fact remains that security is an extremely important part of any application.

One of the most common ways that attackers get into systems is through ...