5.3API Testing Beyond Status 200

Anti-Pattern: API tests that only check expect(response.status).toBe(200). The endpoint returns 200 with completely wrong data — and the test passes.

Pattern: Multi-layer API validation — status codes, response structure, data correctness, error handling, security boundaries.

What to Test in an API

Contract validation — Does the response match the agreed schema? Are required fields present? Are field types correct? Contract testing (with tools like Pact) catches breaking changes between services before they reach production.

Negative testing — What happens with invalid input, missing required fields, wrong data types, excessively large payloads? Does the API return appropriate error codes and helpful (but not leaky) error messages?

Auth and authorization boundaries — Can a regular user access admin endpoints? Can User A access User B's data? Do expired tokens return 401, not 500?

Rate limiting and concurrency — Does the rate limiter work? What happens when the same resource is modified simultaneously?