API testing checklist
Fifteen checks to run against an API before it goes out, each one a command you can paste and a result you can read. Work down the list in order. The contract checks come first because a broken contract makes every later result meaningless, and the release gate is last because it is the only group that needs a decision rather than a measurement.
16 checksabout 82 min end to end
Contract
- How to check API endpoint
Nothing below this line means anything if the endpoint does not answer. - How to check HTTP status code
A wrong status class breaks clients that branch on it, whatever the body says. - How to check HTTP response headers with curl
One pass over the headers surfaces most of what the later checks confirm one at a time. - How to check if API returns valid JSON
An HTML error page served with a JSON content type passes a status check and crashes the client. - How to validate JSON against schema
A field that changed type is the regression clients notice first and report last.
Behaviour under load and failure
- How to check API response time
Take the baseline before release, so the number after release has something to compare against. - How to test API timeout handling
A client with no timeout turns one slow dependency into an outage. - How to test API concurrency
Duplicated side effects show up only when two requests arrive together.
Access and identity
- How to check JWT expiration
A token with no expiry cannot be ended by waiting, only by revocation you may not have built. - How to verify JWT signature
Decoding is not verifying, and a service that confuses the two accepts forged tokens. - How to decode JWT
Read the claims the service actually trusts before trusting them in production. - How to check CORS configuration
A reflected origin with credentials is account takeover, and it looks like a working config. - How to test preflight request
Preflight and the real request are answered by different code, so one can pass while the other fails.
Transport and headers
- How to check SSL certificate expiry
A certificate that expires mid-sprint takes the API down on a date nobody scheduled. - How to check X-Content-Type-Options
Without nosniff, a browser can execute an uploaded file the API meant to serve as data. - How to check referrer-policy header
A token or an object id in a URL leaks to every third-party host the page talks to.
Take it with you
The file is the same list as Markdown checkboxes, ready to paste into a release ticket or a pull request description.
Ticks are kept in this browser only. They are not sent anywhere and other people do not see them.