2. HTTP vocabulary & manual exploration
API Testing · 44 pages source format
Methods, status codes, headers, JSON bodies, auth headers. Explore with curl and browser DevTools before you automate — vocabulary prevents guessing.
What you'll learn
- GET/POST/PUT/PATCH/DELETE
- 2xx/4xx/5xx meaning
- Headers: Content-Type, Authorization
Speak HTTP
GET reads (safe, idempotent). POST creates. PUT replaces. PATCH partial update. DELETE removes. Idempotency matters for retries.
curl -i https://httpbin.org/get
curl -X POST https://httpbin.org/post -H "Content-Type: application/json" -d '{"name":"qa"}'Do this now
Hit httpbin.org/get with curl. Inspect response headers and JSON body.
Status codes that matter
200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 422 Validation, 500 Server Error.
Do this now
Trigger 404 and 401 on httpbin or a public API. Write expected status for 5 scenarios.
JSON request and response bodies
APIs speak JSON. Content-Type: application/json. Parse nested objects — data.user.email patterns.
Do this now
GET jsonplaceholder/users/1. List 5 JSON paths you would assert (id, name, email, etc.).
Auth basics
Bearer token in Authorization header. API keys in header or query (prefer header). Never commit secrets.
Do this now
Read httpbin.org/bearer docs. Send request with dummy Authorization header.