API Testing Course: Postman, pytest and k6 for QA Automation

Explain what happens in a request and a response, and read both with confidence.

• Clients, servers and APIs: REST in simple words
• URLs, paths, query parameters and the request body
• Methods: GET, POST, PUT, PATCH, DELETE and what 'safe' and 'idempotent' mean
• Status codes by family: 2xx, 3xx, 4xx and 5xx, and the ones you see most
• Headers: Content-Type, Accept, Authorization, caching and CORS at a high level
• JSON as the common data format

Browser DevToolsA public practice API such as JSONPlaceholder or httpbin

Practice: Use DevTools to record the requests a real web app makes and explain three of them

Send any request by hand and organise your checks in a Postman collection.

• curl basics: methods, headers, JSON bodies and reading responses
• Postman: requests, collections, folders and saved examples
• Environments and variables: one collection for local, test and live-like setups
• Writing simple checks in Postman: status code, response time and fields in the body
• Running a collection from the command line
• Reading API documentation and OpenAPI files to find what to test

curlPostmanOpenAPI / Swagger UI

Practice: A Postman collection with checks for a public practice API

Test protected endpoints and understand what each login style does.

• API keys, Basic auth, bearer tokens and JWTs in simple words
• Cookies and sessions versus tokens
• Logging in, saving a token and re-using it across requests
• Testing permissions: what each role can and cannot do
• Keeping secrets out of collections and test code

PostmancurlA small Django REST framework API

Practice: Test the login and permission rules of a small Django API by hand

Turn your manual checks into fast Python tests you can run any time.

• The requests library: sessions, timeouts, JSON and error handling
• pytest basics: test functions, assertions and test discovery
• Fixtures for setup and clean-up, such as a logged-in session or test data
• Parametrised tests: one test, many inputs
• Markers to group tests, for example smoke and regression
• A clean project structure: a small client class, helpers and config files

PythonpytestrequestsVS Code

Practice: A pytest suite for a to-do API: create, read, update, delete

Decide what to test so a small suite finds real problems.

• Positive tests: the happy path works
• Negative tests: missing fields, wrong types, bad IDs and wrong methods
• Edge cases: empty values, very long text, boundaries and duplicates
• Equivalence classes and boundary values
• Testing status codes, error messages and response headers
• Test independence and test data: each test sets up and cleans up after itself
• Writing a short test plan for a new endpoint

pytestFaker

Practice: A test plan and automated tests for a sign-up and profile API

Catch changes in response shape before users do.

• Why checking only the status code is not enough
• JSON Schema: types, required fields and allowed values
• Validating responses against a schema in pytest
• Contract testing: what a provider and a consumer agree on, and how breaking changes are caught
• Using an OpenAPI file to drive checks, including generated tests from a tool such as Schemathesis, on your own APIs only
• Versioning and backward compatibility in simple terms

jsonschemaOpenAPISchemathesis (optional)

Practice: Add schema checks to your pytest suite and show a failing test when a field is renamed

Test your code without depending on slow or unreliable outside services.

• Why mock: speed, repeatability and not calling real payment or email services
• Stubs, mocks and fakes: what each one is
• Mocking HTTP calls in Python with a library such as responses or requests-mock
• Mock servers for the API itself, using a tool such as WireMock or a simple local server
• Testing timeouts, slow responses and server errors on purpose
• Test data strategies: factories, seed data and clean-up

pytestunittest.mockresponses or requests-mockWireMock (optional)

Practice: Test a weather or payment-style client that calls an outside API, using mocks only

Measure how an API behaves when many users call it at once.

• Functional, load, stress and spike tests: what each one answers
• Response time, throughput, error rate and percentiles such as p95, explained simply
• Writing a k6 script in JavaScript: virtual users, stages and thresholds
• The same ideas in Locust with Python, for teams that prefer it
• Reading the results and finding the slow endpoint
• Only load test your own app or a practice setup built for it, never someone else's site

k6Locust

Practice: A short load test for your own API with a pass or fail threshold on response time

Run your tests automatically on every push and read the results like a QA engineer.

• GitHub Actions basics: workflows, jobs, steps and triggers
• Running pytest in a workflow with a test database or mock services
• Storing secrets safely in CI
• Test reports: pytest-html, JUnit XML and coverage reports
• Reading a failure: logs, reproducing locally and fixing flaky tests
• Running a Postman collection or k6 check as part of the pipeline

GitHub Actionspytest-htmlcoverage.py

Practice: A workflow that runs your API tests on every pull request and publishes a report

Bring everything together into a suite a team would be happy to adopt.

• Choosing an API to test: your own project or an open practice API
• Writing a test plan and a clear README
• Combining Postman, pytest, schema checks, mocks, a load test and CI
• Presenting results: what passed, what failed and what you recommend

Practice: A GitHub repository with the full suite and a short demo for your batch