API Test Strategy

It is easy to write an order-creation test that sends a valid request, checks for 201 Created, and passes. But what happens when a client loses the response and retries, or when another caller changes the order ID to retrieve someone else's purchase? Duplicate orders and unauthorized access can survive a large suite of tests that checks only successful status codes.

An API test strategy connects important risks to tests that can expose them.

This chapter explains how to divide that work across test boundaries, verify contracts and business effects, reproduce failures, and choose release checks that provide useful evidence without making every test depend on the entire system.