API Testing Tutorial with Examples.
API testing tutorial in Python with requests and pytest: auth, mocking, retries, pagination and OpenAPI contract testing for REST APIs.
Beginner
Start here — no prior experience needed
Testing a REST API with requests and pytest
Write your first automated API test in Python — a GET request, an assertion on the JSON body, and a failure that shows exactly what pytest caught.
HTTP Methods and Body Encodings
Test PUT, PATCH, and DELETE against a real API, then chase down the bug that happens when a JSON API receives a form-encoded body instead.
Fixtures, Sessions, and Parametrize for API Tests
Stop repeating BASE_URL and header setup in every test — share a requests.Session through a pytest fixture, parametrize across cases, and read the ScopeMismatch error that follows.
Intermediate
For developers with core concepts down
Validating JSON Responses and Contracts
Why comparing a whole response body with == breaks on the first dynamic field, and how jsonschema catches a missing or mistyped field that a value check would miss.
Building a Local Test API with the Standard Library
Every remaining lesson in this track needs an API you fully control — build one in under 40 lines with http.server, no framework and no third-party dependency, and give each test a fresh, isolated instance.
Testing Bearer Tokens, Basic Auth, and 401 vs 403
Extend the local test API with two auth schemes and catch the assumption that 'wrong token' and 'no token' return the same status code — they don't, and mixing them up hides real bugs.
Mocking HTTP Calls with responses
Test the client code that calls an API without a real server anywhere — and hit the error responses throws when a test forgets to register the exact call it makes.
Timeouts and Retries Against a Flaky Endpoint
Extend the local test API with a slow route and one that fails a fixed number of times, then measure the difference between a single request, a retrying session, and one with too few retries configured.
Advanced
Production-grade patterns for experienced engineers
Testing Pagination and Rate Limits
The most common pagination bug isn't a broken API — it's a test that hardcodes the number of pages. Then: testing a 429 response and honoring Retry-After.
Contract Testing with OpenAPI, and Running in CI
Turn an OpenAPI document into the same jsonschema validation from earlier in this track, catch a proposed API change that breaks the contract, and wire the suite into GitHub Actions with a JUnit report.
Testing a GraphQL API: 200 OK Is Not a Pass
Test a real GraphQL server with requests and pytest: failed queries that still return 200, partial data, refused queries, schema snapshots, depth limits.
Also part of API Testing
Taught in other topics. Each link opens the lesson in its home topic.
HTTP on the Wire: a Request Is Just Text
Type raw HTTP/1.1 requests into nc against a local nginx: a missing Host header gets a 400, Host picks the site, keep-alive holds the connection open.
Load Testing with Locust: Percentiles, the Knee and a CI Gate
Load-test a real API with Locust in Docker: why the average lies, where latency starts climbing, why user counts mislead, and a p95 budget that fails CI.