API testing glossary

The concepts these APIs exercise, each defined in a paragraph and then demonstrated by an endpoint you can call. Every entry names the misconception people actually hold about it, because that is usually the part standing between reading the definition and getting it right.

• Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
• REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
• ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
• HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
• Bearer token — A credential where possession alone grants access — whoever holds it can use it.
• JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.
• Webhook — An HTTP callback the server sends you when something happens, instead of you polling to ask.
• HMAC signature — A keyed hash proving a payload came from someone holding the shared secret and has not been altered.
• Content negotiation — Client and server agreeing on the format of a response, through headers rather than separate URLs.
• Safe and idempotent methods — Two independent properties of HTTP methods that decide what a client is allowed to retry.
• CORS — The browser rule that decides whether JavaScript on one origin may read a response from another.

Testing techniques · Every HTTP status code · All 39 mock REST APIs