Manual testing guide
API Test Cases: Functional, Validation and Security Examples
API testing should prove more than a successful status code. Useful coverage checks the response contract, input validation, access control, error handling and the system state created by every request.
Example requirement
A secured REST API allows an authenticated user to retrieve a resource by ID and returns consistent status codes, validation errors and access-control responses.
Generate test cases for this example6
Test cases
4
Coverage types
4
High priority
CSV
Export format
6 example test cases
Filter the coverage, switch between card and table views, then copy or export the cases you need. Replace assumptions with the confirmed rules, environments and risks of your product.
Showing 6 of 6 cases
Retrieve an existing resource with valid authorization
Precondition
An accessible resource and valid access token exist.
Expected result
The API returns 200, the requested resource and a response that matches the documented schema.
Steps
- 1.Send a GET request using the valid resource ID and token
- 2.Inspect the status, headers and response body
- 3.Compare the response with the documented contract
Reject a request without authentication
Precondition
The endpoint requires authentication.
Expected result
The API returns the documented authentication error, exposes no protected data and performs no protected action.
Steps
- 1.Send the request without an access token
- 2.Inspect the response and server-visible state
Prevent access to another user's resource
Precondition
Two users own separate resources.
Expected result
Access is denied according to the contract and the other user's data is not disclosed.
Steps
- 1.Authenticate as the first user
- 2.Request the second user's resource ID
Return the documented result for an unknown resource
Precondition
A valid but nonexistent resource ID is available.
Expected result
The API returns the documented not-found response with a stable, non-sensitive error structure.
Steps
- 1.Send the request using the unknown ID
- 2.Inspect the status and error payload
Reject an invalid resource identifier
Precondition
The identifier format is documented.
Expected result
Every invalid value is rejected consistently without an internal error or unintended database lookup result.
Steps
- 1.Send requests using empty, malformed and over-limit IDs
- 2.Compare each response with the validation contract
Keep the response contract backward compatible
Precondition
The published response schema is available.
Expected result
Required fields and types match the contract and no undocumented sensitive data is returned.
Steps
- 1.Request the resource
- 2.Validate required fields, types, nullability and enumerations
- 3.Check that unexpected confidential fields are absent
Coverage checklist
- Assert business outcomes as well as HTTP status codes.
- Test authentication separately from resource-level authorization.
- Validate required fields, types, nullability and error contracts.
- Cover malformed, missing, duplicate and boundary query or body values.
- Confirm retries and duplicate requests do not create unintended state changes.
Related test case examples
Practical login page test cases covering valid access, invalid credentials, validation, accessibility, session handling and security risks.
Registration testingExample registration test cases for required fields, duplicate accounts, password rules, verification, accessibility and input boundaries.
Password reset testingPassword reset test cases covering OTP delivery, expiry, one-time use, password policy, account discovery and active-session behaviour.
Shopping cart testingShopping cart test cases covering add, remove, quantities, prices, stock, promotions, persistence, accessibility and concurrent updates.
Generate cases for your own requirement
Paste your real user story, choose the coverage categories and receive structured manual test cases you can review and export.
Open the free generator