Testing HTTP APIs

## From manual to automated API testing If you've tested APIs with a REST client, you know the loop: send a request, eyeball the response, move on. Automated API tests do exactly the same thing — but repeatably, in milliseconds, and they alert you the moment something regresses. With pytest and the `requests` library, an API test looks nearly identical to a manual check: ```python import requests def test_products_list(): resp = requests.get('https://apilearn.tukas.dev/api/products/') assert resp.status_code == 200 ``` The difference: this runs automatically every time you push, with no one looking at it. ## What to assert in an API test Assert in layers — each layer builds on the previous: 1. **Status code** — is the server responding at all, and with the right code? 2. **JSON structure** — does the response have the keys you expect? 3. **Values** — are specific values correct for this input? ```python def test_products_list(): resp = requests.get('https://apilearn.tukas.dev/api/products/') assert resp.status_code == 200 # layer 1: status data = resp.json() assert 'results' in data # layer 2: structure assert 'count' in data assert isinstance(data['results'], list) # layer 2: type assert len(data['results']) > 0 # layer 3: value ``` Start with the status code. If it's wrong, the rest is noise — your response body might be an error page, not JSON at all. ## BASE_URL: one place to change Define the API base URL once and reference it everywhere. This makes switching between environments (staging, local, production) a one-line change: ```python BASE_URL = 'https://apilearn.tukas.dev' def test_products(): resp = requests.get(f'{BASE_URL}/api/products/') assert resp.status_code == 200 ``` Better yet, put it in `conftest.py` as a fixture — then all test files share it and you can override it per directory. ## Authentication: extract into a fixture Repeating the login flow in every test is fragile. Extract it to a fixture: ```python # conftest.py import pytest import requests BASE_URL = 'https://apilearn.tukas.dev' @pytest.fixture(scope='session') def auth_token(base_url): resp = requests.post(f'{base_url}/api/auth/token/', json={ 'username': 'testuser', 'password': 'TestUser2024!', }) resp.raise_for_status() return resp.json()['token'] @pytest.fixture def auth_headers(auth_token): return {'Authorization': f'Token {auth_token}'} ``` Any test that needs authentication accepts `auth_headers` as a parameter — pytest injects it: ```python def test_profile(base_url, auth_headers): resp = requests.get(f'{base_url}/api/users/profile/', headers=auth_headers) assert resp.status_code == 200 ``` Making `auth_token` session-scoped means the login call happens once per test run, not once per test. ## Designing isolated, repeatable tests A good API test: - **Doesn't depend on test execution order** — it either reads public/stable data, or sets up its own state - **Leaves no side effects** that break other tests — use yield fixtures to clean up anything you create - **Asserts concretely** — check specific values, not just that the response is non-empty For read-only endpoints (GET), tests are naturally isolated. For write operations, clean up with a yield fixture: ```python @pytest.fixture def created_cart_item(base_url, auth_headers): resp = requests.post( f'{base_url}/api/cart/items/', json={'product_id': 1, 'quantity': 1}, headers=auth_headers, ) item_id = resp.json()['id'] yield item_id requests.delete(f'{base_url}/api/cart/items/{item_id}/', headers=auth_headers) ``` ## requests.Response — what you get back ```python resp = requests.get(url, headers={}, params={}) resp.status_code # int: 200, 201, 404, 500, etc. resp.json() # dict or list — parsed JSON body resp.text # str — raw response body resp.headers # dict-like — response headers (case-insensitive keys) resp.url # str — final URL after any redirects resp.history # list — intermediate responses in redirect chain resp.raise_for_status() # raises requests.HTTPError if status_code >= 400 ```