23 API testing exercises you can actually finish

Reading about a 409 is not the same as provoking one. These are 23 things to make the APIs do, in 7 groups, from a first 200 to verifying an HMAC signature on a webhook delivery. Each step ticks itself off the moment a request you run produces the response it asks for — in the browser sandbox or against the live API, either counts — because the runner records every endpoint and status it sees. Nothing is submitted anywhere and there is no account: progress is stored on your own device.

New to the site? Start with the getting started guide, or look up any status code as you go.

First contact (easy)

Send a request, read a status line, and find your way around an endpoint panel.

  1. Get a random Friends quote — a plain 200 with no parameters to fill in. Open the endpoint · Passes on 200 OK
  2. Fetch a single character by id. Open the endpoint · Passes on 200 OK
  3. Ask for a character that does not exist (try id 999) and get a 404 back. Open the endpoint · Passes on 404 Not Found

Errors on demand (easy)

The four error codes every test suite should have a case for, each one request away.

  1. Brew coffee in a teapot and collect your 418. Open the endpoint · Passes on 418 I'm a Teapot
  2. Trip the coffee shop rush-hour rate limit — four requests inside ten seconds gets you a 429. Open the endpoint · Passes on 429 Too Many Requests
  3. Check the pizza oven, which fails by design, for a 500. Open the endpoint · Passes on 500 Internal Server Error
  4. Walk into the bank paywall and get a 402. Open the endpoint · Passes on 402 Payment Required

Auth and roles (medium)

Prove that the same request behaves differently for three different callers.

  1. Call a protected endpoint with no token, or a junk one, and get a 401. Open the endpoint · Passes on 401 Unauthorized
  2. Authorize with qa-admin-token and create a character — a 201 with a Location header. Open the endpoint · Passes on 201 Created
  3. Switch to qa-viewer-token and try a DELETE. Authenticated, but not allowed: 403. Open the endpoint · Passes on 403 Forbidden
  4. Log in for a real signed JWT (admin / admin123) instead of a demo token. Open the endpoint · Passes on 200 OK

Concurrency and caching (medium)

The headers that stop two clients from overwriting each other — and stop you re-sending a payment.

  1. Send an If-None-Match with a current ETag to a standings endpoint and get a 304. Open the endpoint · Passes on 304 Not Modified
  2. Send a stale If-Match on a PUT and get a 412 instead of a silent overwrite. Open the endpoint · Passes on 412 Precondition Failed
  3. Create a conflict a retry cannot fix — book a taken seat, or check out an empty cart: 409. Open the endpoint · Passes on 409 Conflict

Protocol lab (hard)

Asynchronous work, redirects, content negotiation and the two outage codes.

  1. Start a background job and get a 202 with somewhere to poll. Open the endpoint · Passes on 202 Accepted
  2. Follow a permanent redirect and read the Location header off a 301. Open the endpoint · Passes on 301 Moved Permanently
  3. Ask for a representation the server cannot produce and get a 406. Open the endpoint · Passes on 406 Not Acceptable
  4. Hit a maintenance window (503, with Retry-After) or a gateway timeout (504). Open the endpoint · Passes on 503 Service Unavailable, 504 Gateway Timeout

Uploads and partial success (hard)

The two failure modes of file upload, and the status code for “some of it worked”.

  1. Upload a poster the server considers too large: 413. Open the endpoint · Passes on 413 Content Too Large
  2. Upload the wrong content type to the same endpoint: 415. Open the endpoint · Passes on 415 Unsupported Media Type
  3. Bulk-create characters where only some of them are valid and read the 207 body. Open the endpoint · Passes on 207 Multi-Status

Webhooks end to end (hard)

Subscribe, trigger, and verify the signature that proves the delivery was not forged.

  1. Create a webhook subscription and keep its secret. Open the endpoint · Passes on 201 Created
  2. Trigger an event and watch a delivery attempt come back. Open the endpoint · Passes on 201 Created, 200 OK

Testing techniques explained · All 39 mock REST APIs