API Testing Learning Path: Start Here
In short: you learn API testing in 6 milestones, on free practice APIs
— one of which has deliberate bugs for you to find. You go from single
curl requests to a collection that runs in CI, an automated suite in code,
and security and performance checks.
Read this page once to see the plan. Then, for each milestone, follow the same four steps: learn → test → check → commit. Come back here whenever you're unsure what to do next.
Before you start
- A terminal with
curl(built into macOS, Linux and Windows 10+). - Postman (free) from Milestone 4.
- For Milestone 5: Python 3.10+ or Node.js 20+ — pick the language you use at work.
- Helpful: the manual testing path Milestones 1–3, for test design and bug reports.
The pages in this learning path
In short: each page has one job, so nothing is explained twice.
| Page | What it's for | When to open it |
|---|---|---|
| This roadmap | The plan: what each milestone covers and how to check yourself | At the start of each milestone |
| API testing cheat sheet | Learn each idea: short explanation, real request and response, exercise | The "learn" step of every milestone |
| Milestones & Mini-Projects | Tasks with expected results, answer keys and solutions | The "test" and "check" steps |
| Quick Reference | Status codes, curl flags, checklists, the same request in five tools | Any time you're testing |
| Best Practices | Habits that find real bugs and keep suites reliable | After Milestone 3, then on every pull request |
| API testing guide | The whole service, including the OWASP API Top 10 | When you want the deeper "why" |
The milestones
| Milestone | You learn | You work on | Rough time |
|---|---|---|---|
| 1 | HTTP, methods, status codes, JSON, headers, parameters | Exploring two APIs with curl | 1 week |
| 2 | Auth, CRUD, reading back | A booking's full life cycle | 1 week |
| 3 | Negative testing, bug reports | Bug hunt: Restful Booker | 1 week |
| 4 | Postman, variables, test scripts, Newman | A collection that runs from the command line | 1 week |
| 5 | Tests in code, fixtures, builders, schemas, known bugs | An automated suite in Python or TypeScript | 1–2 weeks |
| 6 | GraphQL, API security, API performance | Three short investigations | 1–2 weeks |
Times assume about 5 hours a week.
For each milestone:
- Learn — read the cheat-sheet sections listed below and run their examples.
- Test — do the tasks in Milestones & Mini-Projects.
- Check — compare with the expected results. Only then open the answer key or solution.
- Commit — keep commands, collections and code in a repo:
api-testing-portfolio/
├── m1-explore/requests.sh
├── m2-crud/crud.sh
├── m3-bug-hunt/bug-reports.md
├── m4-postman/booker.postman_collection.json
├── m5-suite/tests/…
└── m6-investigations/graphql.md, security.md, perf/api-smoke.js
Milestone 1: Explore with curl
Learn: What an API is · Request & response · Methods · Status codes · JSON · curl · Headers · Path & query parameters
Work on: Exploring two APIs
Check yourself:
- What's the difference between a 401 and a 403?
- Why is a 500 always worth a bug report?
- What does the
Acceptheader ask for?
Milestone 2: CRUD & auth
Learn: Authentication · A CRUD test flow · What to check · Quick Reference: Auth
Work on: A booking's life cycle
Check yourself:
- Why read data back after a write?
- What's the difference between
PUTandPATCH? - Is Base64 encryption? Why does that matter for Basic auth?
Milestone 3: Bug hunt
Learn: Negative testing · Idempotency · Common mistakes · Quick Reference: Negative test ideas, Bug report for an API
Work on: Bug hunt: Restful Booker
Then read: Best Practices, sections 1–5.
Check yourself:
- What should an API return for a missing required field?
- Why is "silently accepted" often worse than "rejected"?
- What makes an API bug report reproducible in seconds?
Milestone 4: Postman & Newman
Learn: Postman & Newman · Quick Reference: Postman scripts, Newman · Postman guide
Work on: A collection that runs from the command line
Check yourself:
- How does one request pass a value (like a token) to the next?
- Why keep credentials in an environment file, not the collection?
- How does Newman make a CI job fail?
Milestone 5: Tests in code
Learn: Schema validation · Tests in code · Lists & filters · Quick Reference: Same request, five tools
Work on: An automated suite
Then read: Best Practices, sections 6–12.
Check yourself:
- Why should a test for a known API bug assert the correct behaviour?
- What does a schema check catch that value checks miss?
- Why fetch the token in a fixture?
Milestone 6: GraphQL, security & performance
Learn: Contract testing · Mocking · GraphQL · API security · API performance · Quick Reference: Security checks
Work on: Three investigations
Check yourself:
- Why isn't HTTP 200 enough to pass a GraphQL test?
- What is BOLA, and how do you test for it?
- Why keep load tiny on shared demo APIs?
When you get stuck
| Problem | What to do |
|---|---|
curl shows nothing | Add -i or -v to see status and headers |
| JSON error in your request | Validate the body: echo '<json>' | python3 -m json.tool |
| 403 on update/delete | Get a new token — tokens expire; check the Cookie: token= header spelling |
| 404 for a booking you made earlier | Restful Booker resets its data regularly — create a fresh one |
| Postman works, code doesn't | Compare headers; Postman adds some automatically. Use curl -v from Postman's code view |
What's next
- Put API tests into a full framework: Test automation path, Milestone 4.
- Load-test properly: Performance testing guide.
- Go deeper on security: Security testing guide.
Good resources to use alongside: the free OWASP API Security Top 10 and MDN's HTTP reference for status codes and headers.