Is API testing integration testing? Sometimes. This guide explains API integration testing, how it differs from unit, contract and end-to-end tests, how to handle dependencies with Testcontainers, service virtualization and mocks, and walks through a docker-compose + pytest example that runs in CI.
Mocking vs stubbing for APIs, plus fakes, spies and service virtualization: what each test double does, when to use which, and worked examples with WireMock, MSW and Prism.
How to load test an API properly: load, stress, spike and soak tests, the metrics that matter (p95, p99, throughput, error rate), open vs closed workload models, SLOs, a worked k6 and JMeter example, CI gating and the mistakes that make results meaningless.
A 76-item API security testing checklist mapped to the OWASP API Security Top 10 (2023), with test ideas per risk, JWT and OAuth checks, rate limiting, data exposure and logging, and a downloadable CSV you can import into your test tracker.
A ready-to-use pack of 40 login API test cases (positive, negative, validation, security-behaviour and session cases) with inputs, expected status codes and results, a pytest automation snippet and a downloadable CSV.
A ready-to-use pack of 36 API pagination test cases for offset/limit, page/size, cursor and keyset pagination: boundaries, ordering stability, concurrent inserts, total counts and RFC 8288 Link headers, with pytest code and a free CSV.
A complete, fill-in API test plan template: scope, environments, entry and exit criteria, risk register, coverage targets, test data, tools, CI quality gates and reporting, plus a one-page API test strategy and a downloadable Markdown file.
A hands-on guide to API testing in C# on .NET 8: HttpClient with xUnit and NUnit, RestSharp, FluentAssertions, JSON schema checks, in-process tests with WebApplicationFactory, and running the suite in CI with dotnet test.
22 concrete API testing examples grouped by type: functional, negative, auth, schema, pagination, rate limit, idempotency, performance smoke and security basics. Each has the request, the expected result and an assertion in REST Assured, pytest or a Postman test script.
