API & Project Understanding

Before sending requests in Postman, analyze the complete API flow.

Exercise 1: Identify All APIs

Identify all APIs used in the application.

Examples:

Advertisement
  • Login
  • User
  • Orders

For RESTful Booker:

  • /auth
  • /booking
  • /booking/{id}

Exercise 2: Categorize APIs

Separate APIs into:

  • Public APIs
  • Secured APIs

Example:

Public

  • GET Booking

Secured

  • POST
  • PUT
  • PATCH
  • DELETE

Exercise 3: Identify API Dependencies

Understand relationships between APIs.

Example:

  • Authentication
  • Token Generation
  • Update
  • Delete

Flow:

Auth → Token → Update/Delete

Exercise 4: Decide Testing Priority

Identify which APIs should be tested first during a sprint.

Exercise 5: Identify API Boundaries

Understand what the API should and should not handle.

Exercise 6: Analyze API Flow

Analyze API calls from the browser's Network tab.

Exercise 7: Identify Business Validations

Examples include:

  • Check-in < Check-out
  • Total Price > 0

Exercise 8: Identify Smoke vs Regression APIs

Examples:

Smoke

  • Authentication
  • Get Booking

Regression

  • Complete CRUD Flow

Exercise 9: Identify Automation Candidates

Determine which APIs are suitable for automation.

Exercise 10: Explain API Testing Scope

Understand:

Interview Line

"I analyzed API flows before testing."

Postman Project Setup (Company-Style)

Practice organizing Postman like a real company project.

Exercise 1: Create a Project Workspace

Examples:

  • Booking_Management_API_Project
  • API_Automation_Project

Exercise 2: Create Environments

Create separate environments for:

  • DEV
  • QA
  • STAGE

Exercise 3: Organize Collections

Create folders such as:

  • Auth
  • Booking
  • User
  • Order
  • Negative_Scenarios
  • Regression
  • Smoke

Exercise 4: Define Naming Conventions

Maintain consistent request naming.

Exercise 5: Import Swagger APIs

Import APIs using:

  • Swagger
  • Manual Import

Exercise 6: Share Collections

Practice:

  • Sharing Collections
  • Exporting Collection JSON

Exercise 7: Maintain Version History

Maintain:

  • Versioned Collections
  • Change History

Exercise 8: Maintain Documentation

Use Postman to maintain:

Purpose

Organize Postman collections so they remain maintainable, shareable, and easy to navigate.

HTTP Methods (CRUD Exercises)

Practice CRUD operations in Postman.

GET Request

Practice:

  • Fetch Dashboard Data
  • Fetch All Booking IDs

Validate:

  • Response Data
  • Headers
  • Schema

POST Request

Create resources such as:

  • User Registration
  • Create Booking

Validate:

  • 200 / 201 Status Code
  • Generated ID
  • Response Body
  • Response-Time SLA

PUT Request

Perform complete updates.

Validate:

  • Updated Data
  • PUT Idempotency

PATCH Request

Perform partial updates.

Validate that unchanged fields remain unchanged.

DELETE Request

Practice:

  • Soft Delete
  • Hard Delete

Validate:

  • Delete Status

RESTful Booker returns:

201

Also validate that fetching the deleted resource returns:

404

HTTP Method Validation

Practice:

  • Correct HTTP Method Usage
  • PUT Idempotency
  • GET Retry Behavior
  • Unsupported Methods (405)
  • Business Status Codes

Request Data Handling

Practice sending different request data.

Dynamic Query Parameters

Pass:

  • Pagination
  • Filters

Path Parameters

Example:

/booking/{{bookingId}}

Mandatory vs Optional Fields

Remove mandatory fields and validate the response.

Header-Based APIs

Validate APIs requiring request headers.

Nested JSON Payloads

Send requests containing nested objects.

Default Values

Validate default field values when data is omitted.

Large Payloads

Validate APIs using large request bodies.

Content-Type Validation

Practice content-type mismatch scenarios.

Example:

  • Price as String

Encoding Validation

Handle request encoding issues.

Special Characters

Validate requests containing special characters.

Demo-API Mapping

API Understanding & CRUD

Practice primarily using:

  • RESTful Booker

Endpoints include:

  • /auth
  • /booking
  • /booking/{id}

HTTP Methods

Practice using:

  • RESTful Booker
  • ReqRes

Exercises include:

  • CRUD
  • Unsupported Methods
  • 405 Validation

Request Data Handling

Practice using:

  • RESTful Booker
  • FakeStore API
  • DummyJSON-style payloads

Exercises include:

  • Path Parameters
  • Nested Objects
  • Content-Type Validation

FAQs

What Should Be Analyzed Before Testing an API?

Analyze:

  • API Endpoints
  • Public vs Secured APIs
  • Dependencies
  • Business Rules
  • Smoke Scope
  • Regression Scope
  • Automation Suitability

How Should a Company-Style Postman Project Be Organized?

Maintain:

  • Project Workspace
  • DEV / QA / STAGE Environments
  • Auth Folder
  • Booking Folder
  • Negative Scenarios
  • Regression Suite
  • Smoke Suite
  • Naming Conventions
  • Versioned Collections
  • Documentation

Which CRUD Exercises Should Be Practiced?

Practice:

GET

  • Fetch
  • Validate

POST

  • Create
  • Validate Generated ID

PUT

  • Full Update
  • Idempotency

PATCH

  • Partial Update
  • Validate Unchanged Fields

DELETE

  • Delete Resource
  • Validate Status
  • Verify Deleted Resource Returns 404

How Should Unsupported Methods Be Tested?

Send an incorrect HTTP method to the endpoint.

Example:

  • Send POST as GET

Validate that the API returns:

405 — Method Not Allowed

Which Request Data Scenarios Should Be Practiced?

Practice:

  • Query Parameters
  • Path Parameters
  • Mandatory Fields
  • Optional Fields
  • Nested JSON
  • Large Payloads
  • Content-Type Validation
  • Encoding
  • Special Characters