When you log in to an application, search for a product or complete an online payment, different software systems often communicate through Application Programming Interfaces (APIs).
An API allows applications to exchange data and perform operations without requiring users to understand the underlying technical processes.
But what happens if an API returns incorrect information or stops responding?
That is where API testing becomes important.
In this guide, you will learn how to perform API testing using Postman, understand HTTP methods and validate API responses through practical examples.
What Is API Testing?
API testing is the process of verifying that an API behaves according to its requirements.
Testers check whether the API returns the expected responses, handles invalid data correctly and enforces appropriate access controls.
For example, an e-commerce application's API might allow users to:
- Retrieve product details
- Add products to a shopping cart
- Create an order
- View previous orders
- Update account information
API testing helps verify that these operations work correctly.
Unlike user interface testing, API testing focuses directly on the interactions between software components.
What Is Postman?
Postman is an API development and testing platform that allows users to create HTTP requests, inspect responses and automate checks.
Using Postman, testers can examine:
- HTTP status codes
- Response bodies
- Response headers
- JSON data
- Authentication behavior
- Response times
- Error messages
It is useful for both manual API exploration and repeatable test execution.
Step 1: Install and Open Postman
Download Postman from its official website or use a supported web-based workflow.
Create a workspace for your practice project.
Next, create a collection named Beginner API Testing Practice.
Collections help organize related API requests.
For this tutorial, we will use the free public testing API at:
https://jsonplaceholder.typicode.com
JSONPlaceholder provides fictional data that developers can use to practice HTTP requests.
Step 2: Test a GET Request
GET requests retrieve information from an API.
In Postman:
- Create a new HTTP request.
- Select GET as the request method.
- Enter the URL below.
- Click Send.
https://jsonplaceholder.typicode.com/posts/1
You should receive a JSON object containing properties such as:
{
"userId": 1,
"id": 1,
"title": "...",
"body": "..."
}
The exact title and body values depend on the endpoint's response.
Check the status code, response content and headers.
A successful GET request will normally return HTTP 200.
Step 3: Test a POST Request
POST requests are commonly used to submit data to a server.
Create another request in Postman and select POST.
Use:
https://jsonplaceholder.typicode.com/posts
Open the Body tab, select raw and choose JSON.
Enter:
{
"title": "API Testing Practice",
"body": "Learning API testing with Postman",
"userId": 1
}
Click Send.
For this testing service, the API simulates creating a resource and normally returns HTTP 201 Created, including a generated ID.
Important: JSONPlaceholder is a mock API. POST operations do not persist data in a real database.
Step 4: Understand HTTP Status Codes
API testers should be familiar with commonly used response codes.
| Status Code | Meaning |
|---|
| 200 | Request completed successfully |
| 201 | Resource created |
| 204 | Successful response with no content |
| 400 | Bad request |
| 401 | Authentication required or invalid |
| 403 | Access forbidden |
| 404 | Resource not found |
| 500 | Internal server error |
A status code alone is not enough to determine whether an API behaves correctly.
For example, an API might return 200 but include incorrect user information.
Testers should validate both the response code and returned data.
Step 5: Write Automated Test Scripts
Postman supports JavaScript-based assertions.
Open the GET request and select Scripts → Post-response.
Add:
pm.test("Status is 200", function () {
pm.response.to.have.status(200);
});
pm.test("Correct post ID", function () {
const data = pm.response.json();
pm.expect(data.id).to.eql(1);
});
pm.test("Title is present", function () {
const data = pm.response.json();
pm.expect(data.title).to.be.a("string").and.not.empty;
});
Send the request again.
Postman will execute the tests and display the results.
These checks confirm that the API returns HTTP 200, contains the expected post ID and includes a non-empty title.
Step 6: Test Response Time
You can also inspect request duration.
For example:
pm.test("Response time below 2000 ms", function () {
pm.expect(pm.response.responseTime).to.be.below(2000);
});
This checks whether the response was received in less than two seconds.
The threshold is an illustrative learning example, not an industry-wide benchmark.
Actual performance requirements depend on the application, network conditions and service-level objectives.
Step 7: Practice Negative Testing
Positive testing checks whether valid requests work.
Negative testing checks how the system handles invalid or unexpected inputs.
Examples include:
- Missing required fields
- Incorrect data types
- Invalid authentication tokens
- Unsupported HTTP methods
- Non-existent resource IDs
- Requests without required permissions
For example, try requesting a non-existent resource:
https://jsonplaceholder.typicode.com/posts/999999
Inspect the response and verify it against the API's documented behavior.
Do not assume every service handles missing resources identically.
Step 8: Create a Beginner API Testing Project
Build a collection containing:
Test Case 1: Retrieve an existing post.
Expected result: HTTP 200 with valid JSON data.
Test Case 2: Retrieve an unavailable post.
Expected result: A response consistent with the API's missing-resource specification.
Test Case 3: Submit a valid POST request.
Expected result: HTTP 201 and the expected response structure.
Test Case 4: Validate required JSON fields.
Expected result: All mandatory fields are present and use the correct data types.
Test Case 5: Check request duration.
Expected result: Response time satisfies the threshold established for the exercise.
Save your requests and test scripts in a Postman collection.
You can export a sanitized collection to demonstrate your testing approach in a portfolio. Never include passwords, authentication tokens or other credentials.
Common API Testing Mistakes
Checking Only the Status Code
A successful HTTP response does not guarantee correct business logic.
Ignoring Negative Test Cases
Applications should handle incorrect inputs and unauthorized requests appropriately.
Hardcoding Sensitive Information
Credentials should be managed securely rather than included in shared collections.
Not Validating JSON Data
Check values, structures, data types and relevant business rules.
Ignoring API Documentation
Tests should be based on documented requirements, not assumptions about how the API should behave.
Frequently Asked Questions
1. Can beginners learn API testing with Postman?
Yes. Postman provides a visual interface that makes it possible to start testing HTTP APIs before learning advanced automation frameworks.
2. Is coding required for API testing?
Basic API requests can be tested without writing code. JavaScript is useful when creating automated assertions in Postman.
3. What is the difference between GET and POST?
GET retrieves a representation of a resource. POST submits data to a resource, often to create or process information.
4. Can Postman be used for automation testing?
Yes. Postman supports automated assertions, collections and integration with command-line or continuous integration workflows.
5. Is API testing useful for software testing careers?
Yes. Understanding APIs, HTTP methods, JSON, test cases and defect reporting is valuable for many QA and automation testing roles.
Conclusion
API testing is an important skill for understanding how modern applications communicate.
Postman makes it easier to practise HTTP requests, inspect responses and create automated tests.
Start with GET and POST requests, learn response validation and gradually build larger test collections covering positive, negative and security-related scenarios.
To develop broader manual and automation testing skills, explore Itvedant's Software Testing with AI Course.