API 101: Free API Testing Tutorial for Beginners
Learn APIs from zero: what an API is, how HTTP requests and responses work, methods, status codes, REST, GraphQL and SOAP, and authentication — then write your first tests. 22 short lessons, each with a real request you run against a live sandbox.
- Lessons
- 22
- Level
- Beginner
- Signup
- None
Start here: pick your role
Each role starts somewhere different. Pick the one closest to yours and begin with that lesson.
Manual tester going automated
You test APIs by hand in Postman and want automation without a coding career change.
Start with: What is an API? →Start freeAutomation engineer
You write tests in Rest Assured, Playwright or pytest and want to cover more endpoints, faster.
Start with: API negative testing →Start a 15-day trialDeveloper or tech lead
You own the OpenAPI spec and want schema changes caught before they break a consumer.
Start with: Testing validation errors →Start a 15-day trialDevOps or platform engineer
You own pipelines and environments and care about gates, self-hosting and secrets.
Start with: Retries and timeouts →Talk to our architectQA or engineering leader
You are replacing ReadyAPI, Tosca or SOAtest and need strategy, coverage and governance.
Start with: What is shift-left testing? →Talk to our architect9 tracks, from first request to shift-left pipeline
- Track 1 · 5 lessons
API Fundamentals for Beginners
What an API is, requests and responses, HTTP methods, status codes and pagination.
- Track 2 · 10 lessons
REST, GraphQL, SOAP and WebSockets Explained
How REST, GraphQL, SOAP and WebSockets work, and how they differ.
- Track 3 · 4 lessons
API Authentication Explained
API keys, JWTs, OAuth 2.0 and token refresh: the auth concepts behind every protected API.
- Track 4 · 3 lessons
API Testing Basics: Your First Test Patterns
Negative testing, retries and timeouts, and validation errors: the first test patterns to learn.
- Track 5 · Coming soon
OpenAPI, Contract and Schema Testing
Generate tests from an OpenAPI spec, validate schemas and catch contract drift before merge.
- Track 6 · Coming soon
Test Data, Mocks and End-to-End API Testing
Mock servers, mocks versus stubs, test data generation and end-to-end API flows.
- Track 7 · Coming soon
API Testing in CI/CD, Regression and Performance
Pipeline gates, regression packs, load testing and monitoring for your APIs.
- Track 8 · Coming soon
AI and Shift-Left Testing Strategy
Shift-left in practice, AI test generation, LLM testing and agentic testing.
- Track 9 · Coming soon
Shift-Left API in Depth
The 12-step product journey, from first project to CI, one feature per lesson.
Who API 101 is for
API 101 is for anyone starting out with APIs: manual testers moving into API testing, new QA engineers and SDETs, frontend developers who consume APIs, and product people who want to validate an integration themselves. You don't need to code. Every lesson explains one concept in plain English and pairs it with a request you can run from the page, so you see real JSON, headers and status codes instead of screenshots.
How the sandbox works
Lessons are wired to a public sandbox API hosted by Total Shift Left. Click Run and the request goes to a real server over HTTPS. Change headers, swap payloads and break things on purpose — nothing to install, no API keys to manage.
The API 101 course path
Work through the steps in order. Each one builds on the last.
Requests and responses
URLs, headers, bodies, query parameters and pagination.
HTTP methods
GET, POST, PUT, PATCH and DELETE, and what idempotent means.
REST, GraphQL and SOAP
The main API styles, how they work and how they differ.
Authentication concepts
API keys, JWTs, OAuth 2.0 and refreshing tokens.
Write your first API tests
Send a request, assert on status and body, and save it as a test.
Negative testing
Prove the API fails safely on bad, hostile and boundary input.
Retries and timeouts
Test how clients and APIs behave on slow or failing networks.
Validation errors
Make every bad request fail in one predictable, testable shape.
All lessons by section
1. API Fundamentals for Beginners
What an API is, requests and responses, HTTP methods, status codes and pagination.
What is an API? A Plain-English Guide for Testers
An API is how two pieces of software talk to each other. Here's what that actually means — with runnable examples.
Request & Response Anatomy: Headers, Bodies, and Everything In Between
Every HTTP request has the same parts. Once you know them, every API you'll ever test becomes readable.
HTTP Methods Explained: GET, POST, PUT, PATCH, DELETE, QUERY
GET, POST, PUT, PATCH, DELETE — the five verbs that carry 99% of API traffic — plus QUERY, the emerging method for safe reads with a body. Here's what each one means, with runnable examples.
HTTP Status Codes: The Complete Tester's Reference
2xx means success, 4xx means you messed up, 5xx means they messed up — but the details matter. Here's the list every tester should know by heart.
Query Parameters, Pagination, Sorting & Filtering
Every useful API returns lists of things. Here's how to page through, sort, and filter them — with runnable examples.
2. REST, GraphQL, SOAP and WebSockets Explained
How REST, GraphQL, SOAP and WebSockets work, and how they differ.
What is a REST API? The Definitive Guide
REST is the default API style on the web. Here's what it actually means — stripped of jargon and with runnable examples.
REST CRUD Explained: Create, Read, Update, Delete Walkthrough
CRUD is the heartbeat of REST. Create, Read, Update, Delete — walked through end to end.
PATCH vs PUT: The Difference That Trips Everyone
PUT replaces. PATCH modifies. Here's the subtle but critical difference — and why it matters for testing.
RESTful Best Practices: Conventions That Make APIs Predictable
Fifteen conventions that make REST APIs a joy to use — and the absence of any one is a smell.
What is GraphQL? A Practical Introduction for Testers
GraphQL lets the client decide what data to fetch. Here's how it works and when it beats REST.
GraphQL Queries vs Mutations: When and How to Use Each
Queries read. Mutations change state. Here's the divide — and how to write both correctly.
What is SOAP? A Modern Tester's Guide to a Still-Alive Protocol
SOAP isn't dead — it runs banks, insurance, and government. Here's how it actually works.
WSDL Explained: The Contract Behind Every SOAP API
WSDL is the WSDL — Web Services Description Language. It's the source of truth for every SOAP API. Here's how to read it.
What Is SOAP Testing? WSDL, Envelopes and Faults
SOAP testing is different. XPath, XSDs, SOAP Faults. Here's how to do it without losing your weekends.
WebSockets Intro: Real-Time APIs and How to Test Them
WebSockets are persistent, full-duplex, and weirdly under-tested. Here's a practical guide.
3. API Authentication Explained
API keys, JWTs, OAuth 2.0 and token refresh: the auth concepts behind every protected API.
API Keys: The Simplest Authentication That Still Trips People Up
Simple, common, and surprisingly easy to get wrong. Here's the API key playbook.
What Is a JWT? JSON Web Token Structure & Claims
A JWT packs identity claims into a signed string. Here's what's inside the header, payload and signature, and how a server decides to trust it.
OAuth 2.0 Client Credentials: Machine-to-Machine Auth Done Right
OAuth 2.0's machine-to-machine flow. Clean, standard, and easy to test once you see the shape.
Token Refresh Patterns: Rotating, Sliding, and Reactive Refresh
Short-lived access tokens need graceful refresh. Three common patterns, one big pitfall.
4. API Testing Basics: Your First Test Patterns
Negative testing, retries and timeouts, and validation errors: the first test patterns to learn.
API Negative Testing: Breaking Your API Before Attackers Do
Happy paths prove your API works. Negative paths prove it fails safely. Here are the seven categories, a worked example, and where AI generation helps.
Retries and Timeouts: Testing APIs That Live on Unreliable Networks
The network is unreliable. Here's how clients should retry, how servers should behave, and how to test both.
Testing Validation Errors: The Most Neglected Test Category
Most API bugs live in input validation. Here's how to test it systematically.
After API 101: where to go next
Finished the course? These hubs pick up where API 101 stops, with in-depth guides, examples and tools.
API testing hub →
The complete API testing guide, checklists, test-case examples and best practices.
Test automation & tools →
Postman, REST Assured, Karate, pytest and how to automate the tests you just learned.
OpenAPI & contract testing →
Turn an OpenAPI spec into tests and catch breaking changes before clients see them.
API security & auth testing →
Test JWT, OAuth 2.0 and authorization, and work through the OWASP API Top 10.
Protocols: GraphQL, SOAP, WebSocket →
Protocol-specific testing guides once you know how each protocol works.
Practice on your own APIs →
Get the Free Developer License of Shift-Left API: one user, renews free every 6 months.
API testing for beginners: FAQ
How do I start learning API testing as a beginner?+
Start with what an API is and how a request and response are built, then learn HTTP methods and status codes. Once those make sense, learn how REST, GraphQL and SOAP differ and how authentication works, and only then write your first tests. API 101 follows exactly that order.
Is this API testing tutorial free?+
Yes. Every API 101 lesson is free to read and run, with no signup and no credit card. The lessons call a public sandbox API hosted by Total Shift Left.
Do I need to know how to code to learn API testing?+
No. API 101 starts from zero: you read raw HTTP requests and responses and run them from the page. Coding helps later when you automate tests, and the course links to beginner guides for Postman and Python when you get there.
Do I need to install anything?+
No. Lessons run in your browser and send real HTTPS requests to the sandbox, so you can inspect actual JSON, headers and status codes without installing Postman, curl or an SDK.
How long does the API 101 course take?+
Each lesson takes 6 to 11 minutes. Working through the whole course path, including running the sandbox requests, takes a few hours spread over as many sessions as you like.
What should I learn after API 101?+
Move to the blog hubs: the API testing hub for complete guides and test-case examples, test automation for tools and frameworks, and OpenAPI and contract testing for spec-driven tests. To practice on your own APIs, the Free Developer License of Shift-Left API is free for one user and renews every 6 months.
Take what you've learned to your own APIs.
The Free Developer License of Shift-Left API is a single-user license that renews free every 6 months. Import an OpenAPI spec, generate tests, mock APIs and run workflows on your own machine. No credit card.
Free Developer License: 1 user, 50 endpoints, 50 mocks, 50 workflows, AI test generation with your own model key.