Learn API testing, from your first request to a shift-left pipeline.
A free API testing tutorial for beginners that keeps going: HTTP, REST, GraphQL and auth first, then contracts, CI/CD and AI. Short video lessons, each with a real request you run against a live sandbox and a lab you can do in Shift-Left API.
9h 30m of lessons · or jump to the video lessons
5:01Latest video lesson · Shift-Left API in Depth · 6 minAI API Testing Tool: Bring Your Own LLMShift-Left API doesn't ship a model of its own; you bring one. Pick a hosted provider with your own key or a self-hosted model, test the connection, and see which model reviewed your tests.
5:14Shift-Left API in Depth · 6 minAPI Test Automation Framework: GitHub Actions, Azure DevOps and Jenkins
6:08Shift-Left API in Depth · 7 minFree API Security Testing Tools: OWASP Checks and Compliance Mapping
6:25Shift-Left API in Depth · 7 minAPI Performance Testing Tools: Load, Stress, Spike and Soak Tests
5:51Shift-Left API in Depth · 7 minAPI Monitoring Dashboard: Dashboards, TV Mode, Share Links and Printable Reports- 68 lessons in 9 live tracks
- 15 video lessons with chapters
- Real requests, no install, no signup
Pick your role
Manual testers, automation engineers, developers, DevOps and QA leaders each need a different first lesson. Pick the one closest to yours. You don't need to code to start.
Manual tester going automated
You test APIs by hand in Postman and want automation without a coding career change.
Start: What is an API? →Start freeAutomation engineer
You write tests in Rest Assured, Playwright or pytest and want to cover more endpoints, faster.
Start: Generate tests from an OpenAPI spec →Start a 15-day trialDeveloper or tech lead
You own the OpenAPI spec and want schema changes caught before they break a consumer.
Start: How to do API contract testing →Start a 15-day trialDevOps or platform engineer
You own pipelines and environments and care about gates, self-hosting and secrets.
Start: API tests in CI/CD →Talk to our architectQA or engineering leader
You are replacing ReadyAPI, Tosca or SOAtest and need strategy, coverage and governance.
Start: How to do shift-left testing →Talk to our architect
Watch it, run it, practice it
Every lesson follows the same three steps, so you always know what comes next.
Watch
A short video explains one idea in plain English, then shows it done in Shift-Left API. Chapters let you jump straight to the part you need.
Run
Click Run and a real HTTPS request goes to our public sandbox API. Change headers, swap payloads and break things on purpose. Nothing to install, no keys to manage.
See the sandbox API →Practice
Each lesson ends with a lab: do the same task in Shift-Left API, free, and check one result. Mark the lesson complete and your progress is saved in this browser.
9 tracks, from first request to shift-left pipeline
Start with the fundamentals or jump to the track you need.
Track 1
5 lessons · 39 min
API Fundamentals for Beginners
What an API is, requests and responses, HTTP methods, status codes and pagination.
- Manual testers
Track 2
10 lessons · 1h 17m
REST, GraphQL, SOAP and WebSockets Explained
How REST, GraphQL, SOAP and WebSockets work, and how they differ.
- Manual testers
- Developers
Track 3
4 lessons · 29 min
API Authentication Explained
API keys, JWTs, OAuth 2.0 and token refresh: the auth concepts behind every protected API.
- Developers
- QA and engineering leaders
Track 4
3 lessons · 26 min
API Testing Basics: Your First Test Patterns
Negative testing, retries and timeouts, and validation errors: the first test patterns to learn.
- Manual testers
- Automation engineers
Track 5
9 lessons · 1h 24m
OpenAPI, Contract and Schema Testing
Generate tests from an OpenAPI spec, validate schemas and catch contract drift before merge.
- Developers
- Automation engineers
Track 6
8 lessons · 1h 11m
Test Data, Mocks and End-to-End API Testing
Mock servers, mocks versus stubs, test data generation and end-to-end API flows.
- Automation engineers
Track 7
7 lessons · 1h 11m
API Testing in CI/CD, Regression and Performance
Pipeline gates, regression packs, load testing and monitoring for your APIs.
- DevOps engineers
Track 8
7 lessons · 1h 10m
AI and Shift-Left Testing Strategy
Shift-left in practice, AI test generation, LLM testing and agentic testing.
- QA and engineering leaders
Track 9
15 lessons · 15 videos · 1h 43m
Shift-Left API in Depth
The 12-step product journey, from first project to CI, one feature per lesson.
- Manual testers
- Automation engineers
- Developers
- DevOps engineers
- QA and engineering leaders
Watch the latest lessons
Concept, demo in Shift-Left API, and a hands-on lab against the live sandbox, in 6 to 8 minutes.
5:01Shift-Left API in Depth · 6 minAI API Testing Tool: Bring Your Own LLM
5:14Shift-Left API in Depth · 6 minAPI Test Automation Framework: GitHub Actions, Azure DevOps and Jenkins
6:08Shift-Left API in Depth · 7 minFree API Security Testing Tools: OWASP Checks and Compliance Mapping
6:25Shift-Left API in Depth · 7 minAPI Performance Testing Tools: Load, Stress, Spike and Soak Tests
5:51Shift-Left API in Depth · 7 minAPI Monitoring Dashboard: Dashboards, TV Mode, Share Links and Printable Reports
5:34Shift-Left API in Depth · 7 minAPI Test Schedule: Run Now, Test Run Packs and Nightly Runs
New to APIs? Follow these 10 steps.
API 101 is the beginner path through the Learning Center. Each step builds on the last, from your first request to your first negative tests.
Start step 1 →What is an API?
Clients, servers, endpoints and your first real request.
Requests and responses
URLs, headers, bodies, query parameters and pagination.
HTTP methods
GET, POST, PUT, PATCH and DELETE, and what idempotent means.
HTTP status codes
What 2xx, 4xx and 5xx tell you, and which codes to expect.
REST, GraphQL and SOAP
The main API styles, how they work and how they differ.
Authentication concepts
API keys, JWTs, OAuth 2.0 and refreshing tokens.
Write your first API tests
Send a request, assert on status and body, and save it as a test.
Negative testing
Prove the API fails safely on bad, hostile and boundary input.
Retries and timeouts
Test how clients and APIs behave on slow or failing networks.
Validation errors
Make every bad request fail in one predictable, testable shape.
All 68 lessons
Every lesson in every live track, in order.
API Fundamentals for Beginners
- 1What is an API? A Plain-English Guide for Testersbeginner6 min
- 2Request & Response Anatomy: Headers, Bodies, and Everything In Betweenbeginner8 min
- 3HTTP Methods Explained: GET, POST, PUT, PATCH, DELETE, QUERYbeginner9 min
- 4HTTP Status Codes: The Complete Tester's Referencebeginner9 min
- 5Query Parameters, Pagination, Sorting & Filteringbeginner7 min
REST, GraphQL, SOAP and WebSockets Explained
- 1What is a REST API? The Definitive Guidebeginner8 min
- 2REST CRUD Explained: Create, Read, Update, Delete Walkthroughbeginner7 min
- 3PATCH vs PUT: The Difference That Trips Everyonebeginner6 min
- 4RESTful Best Practices: Conventions That Make APIs Predictableintermediate9 min
- 5What is GraphQL? A Practical Introduction for Testersbeginner8 min
- 6GraphQL Queries vs Mutations: When and How to Use Eachintermediate7 min
- 7What is SOAP? A Modern Tester's Guide to a Still-Alive Protocolbeginner8 min
- 8WSDL Explained: The Contract Behind Every SOAP APIintermediate7 min
- 9What Is SOAP Testing? WSDL, Envelopes and Faultsintermediate9 min
- 10WebSockets Intro: Real-Time APIs and How to Test Themintermediate8 min
API Authentication Explained
- 1API Keys: The Simplest Authentication That Still Trips People Upbeginner6 min
- 2What Is a JWT? JSON Web Token Structure & Claimsbeginner8 min
- 3OAuth 2.0 Client Credentials: Machine-to-Machine Auth Done Rightintermediate8 min
- 4Token Refresh Patterns: Rotating, Sliding, and Reactive Refreshintermediate7 min
API Testing Basics: Your First Test Patterns
OpenAPI, Contract and Schema Testing
- 1What Is Swagger Testing? Reading an OpenAPI Spec Like a Testerbeginner8 min
- 2How to Test an OpenAPI Spec: Check the Document, Then the APIintermediate9 min
- 3Swagger Test Case Generation: From Schema Keywords to Test Casesintermediate9 min
- 4JSON Schema Validation Example: One Schema, Three Payloadsintermediate10 min
- 5What Is Schema Validation in API Testing? Requests, Responses and Driftintermediate9 min
- 6How to Do API Contract Testing: A Step-by-Step Methodintermediate10 min
- 7What Is Pact Contract Testing? Consumer-Driven Contracts, Fairly Comparedintermediate10 min
- 8API Versioning Tools: Testing Two Versions of One Contractadvanced10 min
- 9What Should an API Test Coverage Tool Measure?intermediate9 min
Test Data, Mocks and End-to-End API Testing
- 1What Is a Mock API? Mock Servers for API Testingbeginner8 min
- 2API Mocking and Stubbing: Which Test Double Do You Need?beginner8 min
- 3What Is Test Data Generation? Methods, Examples and Where AI Fitsintermediate9 min
- 4What Is Test Data Management in API Test Automation?intermediate9 min
- 5What Is Synthetic Test Data Generation, and When Is It Enough?intermediate9 min
- 6How to Do End to End API Testing: Journeys, Data and Checksintermediate9 min
- 7What Is API Integration Testing? Testing the Seams Between Resourcesintermediate9 min
- 8What Is Microservices Testing? Layers, Mocks and Contractsadvanced10 min
API Testing in CI/CD, Regression and Performance
- 1What Is CI/CD in Automation Testing? API Tests as a Pipeline Gatebeginner9 min
- 2Run API Tests in GitHub Actions: A Hands-On Workflow Labintermediate10 min
- 3API Testing With Jenkins: Jobs, Gates and JUnit Resultsintermediate10 min
- 4Azure DevOps API Test Cases: From Test Plans to a Pipeline Gateintermediate10 min
- 5What Is API Regression Testing? Suites, Schedules and Triageintermediate10 min
- 6API Performance Testing Best Practices: Workloads, Payloads and Reportsadvanced12 min
- 7API Monitoring and Observability: Synthetic Checks, Signals and Alertsintermediate10 min
AI and Shift-Left Testing Strategy
- 1A Shift Left Testing Example: One Requirement, Tested Before the Codebeginner9 min
- 2How to Do Shift Left Testing: Rituals in Agile, Gates in DevOpsintermediate10 min
- 3Shift Left Testing and Shift Right Testing: Where Each Check Belongsintermediate9 min
- 4API Test Automation with AI: What to Hand Over and What to Keepintermediate10 min
- 5Generate API Test Cases Using AI: From a Requirement to a Reviewed Suiteintermediate10 min
- 6LLM Testing and Evaluation for QA Teams: Two Jobs, One Strategyadvanced11 min
- 7API Testing Using AI Agents: Permissions First, Autonomy Secondadvanced11 min
Shift-Left API in Depth
- 1Generate API Test Cases from Swagger: Your First Projectbeginner6 min
- 2API Testing Requirements: From Documents to Traceable Testsbeginner7 min
- 3Spot Changes in Your API Spec: An API Contract Testing Exampleintermediate8 min
- 4Import API Test Cases Using Postman: From Collection to Testsbeginner6 min
- 5AI Test Case Generation Tools: Strategies You Controlintermediate8 min
- 6API Test Cases Format: The Test Workbench and Assertionsbeginner7 min
- 7Sample API Test Cases in Excel Sheet: Data-Driven Testingintermediate7 min
- 8End to End API Testing Framework: Visual Workflows and Workflow Doctorintermediate7 min
- 9Mock API for Integration Testing: Mock Servers from a Specintermediate7 min
- 10API Test Schedule: Run Now, Test Run Packs and Nightly Runsintermediate7 min
- 11API Monitoring Dashboard: Dashboards, TV Mode, Share Links and Printable Reportsintermediate7 min
- 12API Performance Testing Tools: Load, Stress, Spike and Soak Testsintermediate7 min
- 13Free API Security Testing Tools: OWASP Checks and Compliance Mappingintermediate7 min
- 14API Test Automation Framework: GitHub Actions, Azure DevOps and Jenkinsintermediate6 min
- 15AI API Testing Tool: Bring Your Own LLMintermediate6 min
Go deeper on the blog
Finished a track? These hubs pick up where the lessons stop, with in-depth guides, examples and tools.
API testing hub →
The complete API testing guide, checklists, test-case examples and best practices.
Test automation & tools →
Postman, REST Assured, Karate, pytest and how to automate the tests you just learned.
OpenAPI & contract testing →
Turn an OpenAPI spec into tests and catch breaking changes before clients see them.
API security & auth testing →
Test JWT, OAuth 2.0 and authorization, and work through the OWASP API Top 10.
Protocols: GraphQL, SOAP, WebSocket →
Protocol-specific testing guides once you know how each protocol works.
Practice on your own APIs →
Get the Free Developer License of Shift-Left API: one user, renews free every 6 months.
API testing course for beginners: FAQ
Is this API testing course free?+
Yes. All 68 lessons, the 15 video lessons and the practice API are free, with no signup and no credit card. Hands-on labs from the third lesson of each track ask for your email and role once, which unlocks every lab on the site.
Is there a free API testing course with a certificate?+
Not here yet. The Learning Center is free and you can track which lessons you have completed, but it does not issue certificates today; certificates for finishing a track are on the roadmap. If you need a certificate for an employer now, use these lessons to learn and a certified course for the paper.
How do I start learning API testing as a beginner?+
Start with what an API is and how a request and a response are built, then learn HTTP methods and status codes. Next, learn how REST, GraphQL and SOAP differ and how authentication works, and only then write your first tests. API 101, the beginner path on this page, follows exactly that order and you can run every step in your browser.
What is the API testing roadmap from beginner to advanced?+
The Learning Center is laid out as that roadmap, in 9 tracks: API fundamentals; REST, GraphQL, SOAP and WebSockets; authentication; first test patterns; OpenAPI, contract and schema testing; test data, mocks and end-to-end testing; CI/CD, regression and performance; AI and shift-left strategy; and a product track for Shift-Left API itself. Take them in order, or start where your role does.
How long does it take to learn API testing?+
Each lesson takes 6 to 12 minutes. The API 101 beginner path (10 steps) takes about 2 hours, and all 68 lessons take about 9.5 hours. Reading is the quick part: getting comfortable usually takes a few weeks of regular practice against a real API.
Is API testing easy to learn?+
The basics are approachable, because an API test is visible: you send a request and check the response. What takes practice is deciding what to test, such as negative cases, authentication and contracts, and then automating the tests in a pipeline. Learning HTTP first, then test design, then automation keeps each step small.
Do I need to know how to code to learn API testing?+
No. The beginner path starts from zero: you read raw HTTP requests and responses and run them from the page. Coding helps later when you automate tests, and the lessons link to beginner guides for Postman and Python when you get there.
Is there a free API I can use to practice API testing?+
Yes. The lessons use a public sandbox at demo.totalshiftleft.ai: a small store API with users, products and orders, its OpenAPI spec, a GraphQL endpoint and a SOAP service with a WSDL. Flags such as ?delay=2000 and ?error=503 simulate slow and failing responses. It needs no key, each visitor gets a private session, and the data resets when you stop using it.
Do I need to install anything?+
Not to start. Lessons run in your browser and send real HTTPS requests to the sandbox, so you see actual JSON, headers and status codes without installing Postman, curl or an SDK. The hands-on labs use Shift-Left API: the free edition, or the 15-day trial for Test Run Packs, CI and the performance and security add-ons.
Can I track my progress through the lessons?+
Yes. Click "Mark as complete" on a lesson and this page and the track pages show your progress, check off the lessons you have done and offer to continue where you left off. Progress is saved in your browser, so there is no account to create; it does not carry over to another browser or device.
Take what you've learned to your own APIs
The Free Developer License of Shift-Left API is a single-user license that renews free every 6 months: import an OpenAPI spec, generate tests, mock APIs and run workflows on your own machine. No credit card.