How to test a REST API

"Testing" a REST endpoint usually starts with sending a request and glancing at the status code. That catches the obvious failures but misses most of what actually breaks in production. Here's a more complete pass.

1. Check more than the status code

A 200 with an empty or malformed body is still a failure for anyone consuming it. For each endpoint, check:

• The status code matches what the operation actually did (see the status codes reference).
• The response body has the fields you expect, with the types you expect (a numeric id that didn't silently become a string, for example).
• Required response headers are present — Content-Type, pagination headers, rate-limit headers if the API sends them.

2. Test the request, not just the happy path

Most bugs live in the paths nobody tries first. Deliberately test:

• Missing or malformed required fields in the request body.
• An invalid or expired auth token — you should get a 401, not a 500.
• A resource id that doesn't exist — you should get a 404, not an empty 200.
• A value at the edge of a valid range (an empty string, a zero, a very long string).

3. Keep the same request repeatable across environments

If testing an endpoint means editing the base URL and re-typing an API key every time you switch from staging to production, you'll test less often than you should. Keeping a base URL and credentials as environment variables — see environments — and referencing them as {{baseUrl}} means the same request runs anywhere by switching one dropdown.

4. Read the whole response, not just the body

Cookies, response headers, and timing are all part of what an endpoint returns. A response viewer that splits body/headers/cookies into their own tabs makes it faster to notice when one of them is wrong instead of only ever looking at the body.

5. Save what you learn

A request worth testing once is usually worth testing again after the next change. Filing requests into a collection instead of leaving them as one-off scratch requests means the next test is a click, not a rebuild.