# Postman API testing practice: validate a resource and its missing case

Practice assertions against a live training API. You do not need a Fun API account or a secret token. These examples read sample data in your own sandbox.

## Before you start

- Postman with permission to send HTTPS requests.
- Create collection variables baseUrl = https://funapi.dev/api and sandboxId with a unique value such as postman followed by a UUID.
- Add the collection header X-Sandbox-ID: {{sandboxId}} to both requests. Keep the same value throughout this exercise.

## Fetch one character

Create GET {{baseUrl}}/friends/v1/characters/1. Add the script below in the post-response test editor and send the request.

```javascript
pm.test('Existing resource returns JSON', () => {
  pm.response.to.have.status(200);
  pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json');
  const body = pm.response.json();
  pm.expect(body.id).to.eql(1);
  pm.expect(body.name).to.be.a('string').and.not.empty;
});
```

## Check a missing resource

Duplicate the request, change the id to 999999, and replace the tests. A 404 is the intended result of this case.

```javascript
pm.test('Missing resource returns a useful error', () => {
  pm.response.to.have.status(404);
  pm.expect(pm.response.json().error).to.eql('Not Found');
});
```

## Run the collection

Run both requests once in order. Save or export your collection so another learner can reproduce the assertions with their own sandboxId.


## Expected result

Both tests pass: the existing character returns 200 with id 1 and a name; the unknown character returns 404 with an error object.

## Common pitfalls

- Use the /api prefix for network calls; /docs is the browser documentation.
- A 404 test should assert the expected error rather than fail because the response is not 200.
- Do not put personal tokens or private response data in a shared collection.