01 What Is API Testing?
Why testing through the API layer catches real defects a UI-only pass misses — and where API testing fits alongside the manual testing skills you already have.
02 HTTP Fundamentals
Reading a request and response with a tester's precision — methods, status codes, headers, and body — the literacy every later module in this path assumes.
03 REST Architecture and API Design Principles
What a RESTful API's own design conventions promise callers — and why knowing those conventions tells a tester exactly where to look for a violation.
04 API Requests and Responses
Following one request through its full lifecycle — URL, body, and method on the way in; status code, body, and pattern on the way out — the shape every later validation module builds on.
05 Headers, Parameters, and Payload Validation
Testing the three places a request can go wrong before the server even evaluates business logic — headers, path/query parameters, and the request body.
06 Data Validation and Response Verification
Field-by-field validation of a response's data — type, format, nulls, nested structures, and cross-field business rules — the deepest layer of API validation this section builds toward.
07 API Authentication
Testing how an API proves who is calling it — API keys, bearer tokens, JWTs, and OAuth 2.0 — and the specific failure scenarios every authenticated endpoint should be tested against.
08 Authorization and Access Control
Testing what an authenticated identity is actually allowed to do — roles, resource ownership, and the privilege-escalation defects that surface only when you test as one user against another user's data.
09 Rate Limiting, Throttling, and Session Management
Testing an API's defenses against abuse and its handling of session lifecycle — rate limits, burst traffic, idle timeouts, token revocation, and multi-device sessions.
10 Testing Service Integrations
Testing an API that depends on other services — payment gateways, KYC providers, exchange rate feeds — where many production defects trace back to a dependency's behavior, not the endpoint under test itself.
11 Cascading Failures, Error Handling, and Fault Tolerance
Testing what happens when a dependency's failure isn't contained — timeout propagation, circuit breakers, retry storms, and the standardized error contract that keeps one failure from becoming an outage.
12 Idempotency, Retry Logic, and Duplicate Request Prevention
Testing whether a retried request is actually safe — idempotency keys, network-interruption scenarios, and the duplicate-transaction risk that makes this the highest-stakes topic in this section for financial APIs.
13 API Security Fundamentals
Security testing from a QA engineer's vantage point — the OWASP API Security Top 10 at a functional level, and the specific checks that catch broken object-level authorization and excessive data exposure before release.
14 Injection and Input-Based Attacks
Recognizing how an API handles hostile or malformed input, from a QA engineer's identification-focused perspective — not building exploits, but knowing what a vulnerable response looks like and reporting it responsibly.
15 Transport Security, CORS, and Secure Communication
Testing how data is protected in transit and which origins are allowed to call an API — HTTPS enforcement, CORS misconfiguration, and the preflight behavior a tester can verify without specialized security tooling.
16 Performance Testing APIs
Testing an API's response time and behavior under load from a functional tester's vantage point — recognizing a real performance defect, not building a full load-testing practice.
17 API Testing Tools
Choosing between Postman, lightweight REST clients, and code-based API testing approaches based on what the testing task actually needs — not a feature checklist.
18 Applying API Testing: Cross-Border Payment Flow
Combining authentication, resilience, and idempotency testing from Sections 3-4 against one realistic AtlasBank cross-border payment feature, end to end.
19 Applying API Testing: Loan and KYC Flow
Combining data validation, contract expectations, and security testing from Sections 2 and 5 against a realistic AtlasBank loan-application and KYC-verification feature.
20 Common Mistakes in API Testing
The recurring mistake patterns that cut across every module in this path — and why each one is a shortcut that feels reasonable in the moment it's taken.
21 Capstone: International Money Transfer API
The complete API testing lifecycle applied to one realistic, compliance-critical AtlasBank feature — the same International Money Transfer feature Manual Testing's own capstone tested at the UI layer, now tested at the API layer.
Section 1 — Review
A recap of API Testing Foundations — what API testing is, HTTP fundamentals, and REST design conventions — plus a Knowledge Check.
Section 1 — Solutions
Answers and reasoning for Section 1's Knowledge Check — what to check on a response, an error path, related routes, and a documented header contract.
Section 2 — Review
A recap of Data, Contracts, and Test Cases — request/response lifecycle, headers/parameters/payload validation, and deep data validation — plus a Knowledge Check.
Section 2 — Solutions
Answers and reasoning for Section 2's Knowledge Check — request verification, invalid query parameters, format validation, non-round test data, and error-path header consistency.
Section 3 — Review
A recap of Auth and Access Control — authentication, authorization, and rate limiting/session management — plus a Knowledge Check.
Section 3 — Solutions
Answers and reasoning for Section 3's Knowledge Check — per-endpoint authentication enforcement, IDOR, over-permissive roles, rate-limit scope, and server-side session revocation.
Section 4 — Review
A recap of Integration and Resilience — service integrations, cascading failures, and idempotency/retry safety — plus a Knowledge Check.
Section 4 — Solutions
Answers and reasoning for Section 4's Knowledge Check — blocking vs. non-blocking dependencies, undisclosed fallback behavior, cascading failure, and idempotency under sequential and near-simultaneous retries.
Section 5 — Review
A recap of API Security Testing — security fundamentals, injection symptom recognition, and transport/CORS testing — plus a Knowledge Check.
Section 5 — Solutions
Answers and reasoning for Section 5's Knowledge Check — excessive data exposure, injection symptoms, mass assignment, and CORS severity depending on endpoint sensitivity.
Section 6 — Review
A recap of Performance and Tooling — functional performance testing and matching tool category to task category — plus a Knowledge Check.
Section 6 — Solutions
Answers and reasoning for Section 6's Knowledge Check — disproportionate scaling, sibling-endpoint comparison, and matching tool category to task category.