Table Of ContentAutomating and Testing a REST API
A Case Study in API testing using: Java, REST Assured,
Postman, Tracks, cURL and HTTP Proxies
Alan Richardson
Thisbookisforsaleathttp://leanpub.com/testrestapi
Thisversionwaspublishedon2017-08-21
ThisisaLeanpubbook.LeanpubempowersauthorsandpublisherswiththeLean
Publishingprocess.LeanPublishingistheactofpublishinganin-progressebookusing
lightweighttoolsandmanyiterationstogetreaderfeedback,pivotuntilyouhavetheright
bookandbuildtractiononceyoudo.
©2013-2017AlanRichardson
Contents
ThanksforReadingThisSample. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
IntroductiontoAPIs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
WhatIsaWebApplication? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
GoogleIsanExampleofaWebApplication . . . . . . . . . . . . . . . . . . . . . 5
WhatIsanAPI? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
WhatIsanHTTPRequest? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
WhatIsaURL? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
WhatAreHTTPVerbs? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
WhatIsanHTTPResponse? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
WhatIsanHTTPStatusCode? . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
WhatArePayloads? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
WhatIsJSON? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
WhatIsXML? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
WhatAreHTTPHeaders? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
WhatIsAuthentication? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
WhatIsREST? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
WhatToolsAreUsedforAccessinganAPI?. . . . . . . . . . . . . . . . . . . . . 17
ExampleAPIs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
RecommendedReading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
IntroducingTracksCaseStudy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
SupportPage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
HowtoUseThisCaseStudy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
SourceCodeLocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
CaseStudyContentsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
CONTENTS
WhyTestTracks? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
WhatIsTracksandGTD?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
InstallingTracks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
OfficialTracksInstall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Pre-BuiltVirtualMachines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
UsingVirtualMachines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
ATourofTracks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
WhyLearntheGUIIfWeAreTestingtheAPI? . . . . . . . . . . . . . . . . . . . 29
Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
HomeScreen. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
StarredScreen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Admin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
BasicFunctionstoUseandCheckintheAPI . . . . . . . . . . . . . . . . . . . . 35
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
TheTracksRESTAPI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
WhatIsaRESTAPI? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
TracksRESTAPIDocumentation . . . . . . . . . . . . . . . . . . . . . . . . . . 38
APIDocExamples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
GeneralHTTPRESTReturnCodes . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
UsingaProxytoViewGUITraffic . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Why? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
How? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
ViewingTraffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Implications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
ExploringtheTracksAPIwithcURLThroughaProxy . . . . . . . . . . . . . . . . 45
UsingaProxywithcURL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
ForDebugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
ForExploration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
ForSimpleScopeCoverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
CONTENTS
cURLSummary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
ExploringTracksAPIwithPostmanRESTClient . . . . . . . . . . . . . . . . . . . 50
TheGUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
IssueRequests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
PostmanCollections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
EnvironmentVariables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
UsingPostmanThroughaProxy . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
RecreatecURLRequestsinPostman . . . . . . . . . . . . . . . . . . . . . . . . . 57
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
StartingtoAutomate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
WhyExploreFirst? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
ChoosingaJavaLibrary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
RESTAssuredOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
RESTAssuredRelatedReading . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
AbouttheAuthor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
ThanksforReadingThisSample. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Thanks for Reading This Sample
Thanksforreadingthissampleofmy“AutomatingandTestingRESTAPIs”book.Thisisan
excerptfromthemainbook.
There should be enough in the sample to provide general introductory information to help
yougetstartedwithtestingRESTAPIs,specificallytheTracksAPI.
Whatyoubasicallyhaveherearechapters1,2,3,4,5,8,9and10.Soyougettosee:
• Introduction
• Howtoinstalltracks
• AGUItouroftracks
• ThetracksAPIDocumentation
• UsingaProxytoviewGUItraffic
• UsingcURLthroughaProxy
• cURLReferenceGuide
• StartingtoAutomateDecisions
What you don’t see in here is the actual case study, about 120 pages (or more) of extra
information:
• HowIusedcURLtotesttheAPI
• HowIusedaproxyfuzzertocreateusersautomaticallyviaHTTP
• HowIautomatedcreatinguserswithRESTAssuredeventhoughtheRESTAPIdoesn’t
supportit
• CreatingabstractionlayersforRESTAPItestinginJava
• HowtousetheRESTAssuredJava/GroovylibraryforHTTP/RESTTesting
• RandomDataCreation
• RefactoringandNextSteps
Absolutelymassesofvaluableandpracticalcontent.
But you do have links to all the tools, and libraries and you can view the source code on
GitHubsoyoucanseeexactlywhatIwillexplainindetailinthefullbook.
ThanksforReadingThisSample 2
Ihopeyouenjoythesample,andwhenyouarereadytotakethenextstepyoucanfindout
moreaboutthefullbookonmywebsite.
• compendiumdev.co.uk/page/tracksrestapibook1
1http://compendiumdev.co.uk/page/tracksrestapibook
Introduction
Wecanreadon-lineaboutthe“TestAutomationPyramid”andwecanalsolearnthat“GUI
Automation is brittle” and “we should test under the GUI”. Fine. But how many in-depth
examples can you find? Examples that show you how to automate quickly, and how to
improveonthatinitial‘quickfix’?
That’s what this case study is all about - an example of automating an application without
usingGUIbasedlibraries.
Thiscasestudywillshowhowyoucanaddvaluetoaprocessquicklywithfairlycrudeand
“hacky”code,andthenhowyoucanchangethatcodetomakeitbetter.
Throughout the case study, I’m not just going to tell you how I did it. I’m going to explain
why,andwhatIcouldhavedonedifferently.WhyImadethedecisionsImade,becausethen
youcantrydifferentapproachesandbuildonthiscasestudy.
Sincethisisacasestudy,andnota‘stepbystep’course.Iassumesomebasicknowledge:
• YouknowhowtoinstallJavaandanIDE,
– ifyoudon’tthentheStarterPage2 onJavaForTesterswillhelp.
• YouhavesomebasicWebexperienceorHTTPknowledge,
– if not then my Technical Web Testing 1013 course might help or my YouTube
channel4.
I’ll cover some of the above topics, although not in depth. If you get stuck you can use the
resourcesaboveorcontactme5.
ThebackgroundbehindthiscasestudyisthatI’veusedTracksasanApplicationUnderTest
inafewworkshops,forpractisingmyowntesting,andtoimprovemyabilitytoautomate.
FortheworkshopsIbuiltcodetocreateusersandpopulatetheenvironmentwithtestdata.
I found that people like to learn how to do that, and I realised during the workshops that I
alsoapproachthisdifferentlytootherpeople.
2http://javafortesters.com/page/install/
3http://compendiumdev.co.uk/page.php?title=techweb101course
4http://eviltester.com/youtube
5http://compendiumdev.co.uk/contact
Introduction 4
Ididn’tautomateundertheGUIbecauseIfollowa“TestAutomationPyramid”.Iautomated
beneaththeGUI:
• becauseitisfast,
• becausewecandothingswecan’tdothroughtheGUI.
By‘UndertheGUI’Imean:
• UsingtheAPI(ApplicationProgrammingInterface).
• Usingthe‘APPasAPI’,
– sendingthroughtheHTTPthattheGUIwouldhavesent,butnotusingtheGUI.
Iexplain‘AppasAPI’inthecasestudylater,andshowexamplesofitinpractice.Irealised,
duringtheteachingofthisstuff,thatmostpeopledon’tautomateinthisway.
Formostpeopletesting‘undertheGUI’meansAPI.Tomeitmeansworkingatthedifferent
systemcommunicationpointsanywhere‘under’theGUI.Iexplainthisinthecasestudyas
well.
WorkingundertheGUIisn’talwayseasier.Inthiscasestudyyou’llseethatworkingthrough
theGUIwouldhavebeen‘easier’.Iwouldn’thavehadtomanagecookiesessionsandscrape
dataoffpages.
ButworkingbeneaththeGUIisfaster,onceitisworking,andarguablyismorerobust-but
we’llconsiderthatinmoredetailinthecasestudyandyou’llseewhenitisn’t.
You’llseeinitialcodethatIusedforTracks2.2andthenupdatedfor2.3,I’llwalkyouthrough
thereasonsforthechangesandshowyoutheinvestigationprocessthatIusedandchanges
Imade.
If you haven’tautomated an HTTP application belowthe GUI before then I think this case
studywillhelpyoulearnalot,andyou’llfinishwithastackofideastotakeforward.
IfyouhaveautomatedtheGUIbefore.Ithinkyou’llenjoylearningwhyImadethedecisionsI
made,andyou’llbeabletocomparethemwiththedecisionsyou’vemadeinthepast.Ithink,
afterfinishingthecasestudy,youmightexpandtherangeofdecisionsyouhaveopentoyou
inthefuture.
Introduction to APIs
ThischapterwillprovideanintroductiontotheconceptofanAPI(ApplicationProgramming
Interface) and concentrates on Web or Internet accessible APIs. I will explain most of the
concepts that you need to understand this book and I will start from the very basics. Most
of this chapter will be written colloquially for common sense understanding rather than to
provideformalcomputersciencedefinitions.
You can probably skip this chapter if you are familiar with Web Services, URI and URL,
HTTP,HTTPStatusCodes,JSONandXML.
Also, because this chapter covers a lot of definition, feel free to skip it if you want to get
stuckintothepracticalaspects.Youcanalwayscomebacktothischapterlaterifyoudon’t
understandsomebasicterminology.
First I’ll start by saying that we are going to learn how to test Web Applications. i.e.
Applicationsthatyoucanaccessoveranetworkortheinternetwithoutinstallingthemon
yourmachine.
The Web Application we will test has an API, which is a way of accessing the application
withoutusingaWebBrowserortheapplication’sGraphicalUserInterface(GUI).
What Is a Web Application?
AWebApplicationisasoftwareapplicationthatisdeployedtoaWebServer.Thismeansthe
applicationisinstalledontoacomputerandusersaccesstheapplicationviaaWebBrowser.
Google Is an Example of a Web Application
google.comisanexampleofaWebApplication.Auservisitsgoogle.cominaBrowserand
theapplication’sGraphicalUserInterface(GUI)isdisplayedintheBrowser.TheGUIconsists
ofasearchinputfieldwhichtheuserfillsinandthenclicksabuttontosearchtheWeb.
Whentheuserclicksthesearchbutton,theBrowsermakesarequesttotheWebApplication
on the Web Server to have the Google Search Application make the search and return the
resultstotheuserintheformofawebpagewithclickablelinks.
Basically,
