8.5The Request/Response Cycle

Client                                  Server
  |                                       |
  |-- HTTP Request ---------------------->|
  |   Method: POST                        |
  |   URL: /api/users                     |
  |   Headers:                            |
  |     Content-Type: application/json    |
  |     Authorization: Bearer token       |
  |   Body: {"name": "Alice"}             |
  |                                       |
  |<-- HTTP Response --------------------|
  |   Status: 201 Created                |
  |   Headers:                           |
  |     Content-Type: application/json   |
  |     Location: /api/users/42          |
  |   Body: {"id": 42, "name": "Alice"} |

What to Verify at Each Layer

1. Status code: Did the server accept/reject the request correctly?
2. Response headers: Are security headers present? Is the content type correct?
3. Response body: Does the data match expectations? Are all fields present?
4. Response time: Is the response within acceptable latency?
5. Side effects: Did the server actually create/update/delete the resource?