Exercises
3.1🔒BeginnerExercise 11: Write a test that verifies the response from GET /posts on JSONPlaceholder contains an array of objects, each with id, title…
3.2🔒IntermediateExercise 13: Implement JSON Schema validation for a POST /posts response. Define the schema with required fields and types, and validate…
3.3🔒AdvancedExercise 15: Write a parametrized test that validates sorting across multiple fields and directions (sort=name, sort=-name…
3.4🔒Q&AResume phrasing- Implemented JSON Schema validation across 45 API endpoints, catching 12 response structure regressions in the first month that…
3.5🔒Q&ACover letter framingStatus code validation is table stakes -- the real value of API testing comes from deep response validation. I build test suites that…
3.6🔒Q&AInterview framing"I validate API responses at multiple layers. First, status codes to confirm the right operation happened. Second, JSON Schema validation…
3.7🔒Q&AWhat not to say- "I only check the status code -- if it is 200, the test passes." -- This misses the most damaging category of bugs: correct status code…
3.8🔒Q&AQuestion 1Prompt: Your API returns a paginated list of 10,000 users. A customer reports they are seeing duplicate users when scrolling through pages…
3.9🔒Q&AQuestion 2Prompt: You need to validate that your API never exposes sensitive fields (password_hash, ssn, credit_card) in any response. How do you…
3.10🔒Q&AQuestion 3Prompt: A developer adds a new optional field metadata to the user response. Your JSON Schema validation test starts failing because it…
3.11🔒Client Credentials Flow (Machine-to-Machine)
3.12🔒Authorization Code Flow (User-Facing)The authorization code flow involves a browser redirect, which makes it harder to test purely via API calls. However, you can test the…
3.13🔒Horizontal Authorization (IDOR Prevention)Users should not be able to access other users' data. Insecure Direct Object References (IDOR) are among the most common API…