SQA-Notes

### **SQA Interview Notes & Testing Questions: API Testing (RESTful Services)**

**Key Concepts:**
- **HTTP Methods:** GET (retrieve data), POST (create), PUT (update), DELETE (remove).
- **Status Codes:** 200 (OK), 201 (Created), 400 (Bad Request), 401 (Unauthorized), 404 (Not Found), 500 (Server Error).
- **Authentication:** OAuth 2.0, API Keys, JWT (JSON Web Tokens).
- **Payload Validation:** JSON/XML schema validation, required fields, data types.

**Common Interview Questions:**

1. **How do you test a POST request in a REST API?**
   - Use tools like Postman or cURL to send a POST request with a JSON payload.
   - Validate the response status code (e.g., 201 for success).
   - Check the response body for the created resource ID or confirmation message.
   - Example:
     ```bash
     curl -X POST https://api.example.com/users \
          -H "Content-Type: application/json" \
          -H "Authorization: Bearer <token>" \
          -d '{"name": "John Doe", "email": "[email protected]"}'
     ```

2. **What is the difference between PUT and PATCH in REST APIs?**
   - **PUT:** Replaces the entire resource. If a field is missing, it may be set to null or default.
   - **PATCH:** Partially updates the resource. Only the provided fields are modified.
   - Example:
     ```http
     PUT /users/123 { "name": "Jane Doe", "email": "[email protected]" }
     PATCH /users/123 { "name": "Jane Doe" }
     ```

3. **How would you validate an API response?**
   - Check the status code (e.g., 200 for success).
   - Validate the response body against a schema (e.g., using JSON Schema).
   - Ensure required fields are present and data types are correct.
   - Example (using Postman Tests):
     ```javascript
     pm.test("Status code is 200", function() {
         pm.response.to.have.status(200);
     });
     pm.test("Response has required fields", function() {
         const response = pm.response.json();
         pm.expect(response).to.have.property("id");
         pm.expect(response).to.have.property("name");
     });
     ```

**Real-World Scenarios:**

- **Scenario 1:** Testing an e-commerce API for order creation.
  - **Steps:**
    1. Send a POST request to `/orders` with a valid payload.
    2. Verify the response status code is 201.
    3. Check the response body for the order ID and confirmation.
    4. Send a GET request to `/orders/{id}` to validate the order exists.
  - **Common Pitfalls:** Missing required fields (e.g., `customer_id`), invalid payload format.

- **Scenario 2:** Testing authentication for a banking API.
  - **Steps:**
    1. Send a POST request to `/auth/login` with valid credentials.
    2. Verify the response status code is 200 and includes a JWT token.
    3. Use the token to send a GET request to `/accounts` and validate the response.
  - **Common Pitfalls:** Incorrect credentials, expired tokens, missing headers.

**Tips for Success:**
- Use tools like Postman, cURL, or REST Assured for API testing.
- Automate tests using frameworks like JUnit, TestNG, or PyTest.
- Mock APIs for testing edge cases (e.g., using MockServer or WireMock).
- Collaborate with developers to understand API design and constraints.

**Further Reading:**
- [REST API Tutorial](https://restfulapi.net/)
- [Postman Learning Center](https://learning.postman.com/)
- [JSON Schema Validation](https://json-schema.org/)

---
*This study guide is designed to help SQA professionals prepare for interviews and real-world testing scenarios. Adjust the focus based on your specific needs (e.g., SOAP APIs, GraphQL, or security testing).*