Web & API Testing

1xx is informational, 2xx success (200 OK, 201 Created, 204 No Content), 3xx redirection (301/302), 4xx a client error (400 Bad Request, 401, 403, 404), 5xx a server error (500, 502, 503). The first digit signals who is responsible — the client sent something wrong (4xx) or the server failed (5xx).

An API is a contract that lets systems exchange data without a graphical screen — the client sends a request, the server returns a structured response. Testing it separately is faster, can start before the UI exists, isolates backend bugs from UI bugs, and makes negative and edge cases easy to cover and automate.

GET reads data and passes parameters in the URL query string (?a=1&b=2), so it is cacheable, idempotent, length-limited, and visible in logs. POST creates or submits data in the request body, is not cached, and is not idempotent.

In client-server architecture the client sends a request, the server processes it and returns a response; the two communicate over a network protocol such as HTTP. The client is anything that initiates requests — a browser, a mobile app, another backend service, a CLI tool, or an IoT device — not only a person at a screen.

The four base methods map to CRUD: GET reads a resource, POST creates a new one, PUT replaces or fully updates one, DELETE removes it. PATCH applies a partial update. GET carries parameters in the URL query string; POST, PUT, and PATCH carry data in the request body.

Idempotent means repeating the same request any number of times leaves the server in the same state as sending it once. GET, PUT, DELETE, and HEAD are idempotent; POST is not, because each call creates a new resource. Idempotency does not require identical responses — only identical resulting state.

Use plural noun resources and a version prefix: POST /v1/exchanges/{id}/users → 201 (create on an exchange); GET /v1/users → 200; GET /v1/exchanges/{id}/users/{userId} → 200 (one user); grant access is creating an access resource: POST /v1/exchanges/{id}/users/{userId}/access → 201, or PUT the membership → 200. It is RESTful because resources are nouns in the URL, the HTTP verb carries the action, status codes are used correctly, and the design is stateless and consistently versioned.

Common schemes: Basic Auth (base64 credentials in a header, safe only over HTTPS), Bearer/JWT tokens, API keys, OAuth 2.0, Digest, session cookies, and mTLS. They differ in where the secret lives, whether it expires, and in delegation.

JSON has six value types: string (always in double quotes), number, boolean (true/false), null, object {}, and array []. Keys must be double-quoted strings. The format forbids trailing commas, comments, single quotes, and leading zeros, and numbers use a dot as the decimal separator.

The precise answer is 401 Unauthorized — the request lacks valid authentication credentials. 403 Forbidden is different: the user is authenticated but not allowed. Some APIs return 400 Bad Request if the body itself is malformed, but for valid-shaped wrong credentials, 401 is correct.

HTTPS is HTTP over TLS: traffic is encrypted, the server is certificate-authenticated, and data is tamper-protected. Plain HTTP is clear text anyone on the path can read or alter. Both use one message shape: status line, headers, body.

It reads request headers the client sends. User-Agent carries the browser, OS, and device; Accept-Language carries the preferred language; the client IP and cookies add more context. The server uses these for content negotiation — serving a localized page or a device-appropriate response — which is why the same URL can return different content per client.

REST is an architectural style around resources and URLs that reuses HTTP verbs, is stateless, and commonly returns JSON — lightweight and flexible. SOAP is a strict protocol that wraps every message in an XML envelope, is described by a WSDL contract, is transport-agnostic, and carries built-in standards like WS-Security — heavier but more formal.

In synchronous communication the caller blocks and waits for the response before continuing. In asynchronous communication the caller continues immediately and the result arrives later via a callback, poll, webhook, or message queue. For testers, async brings timeouts, eventual consistency, and race conditions that synchronous flows avoid.

Kafka (a message broker passing messages between services) groups messages into partitions, and consumer groups read them in parallel. Duplicates appear under at-least-once delivery: a consumer processes a message but crashes before committing its offset, so it is re-delivered. They are handled by deduplication — idempotent processing keyed on a unique message key, or an idempotent producer, so reprocessing has no extra effect. At-most-once avoids duplicates but risks losing messages.

Variables let you reuse values (URLs, tokens, ids) across requests instead of hard-coding them. Postman resolves scopes narrowest-wins: Local > Data > Environment > Collection > Global, so a local variable beats a global one of the same name. On a collection run, the collection-level pre-request script runs first, then each request's own pre-request script before that request fires.

WSDL (Web Services Description Language) is an XML document that formally describes a SOAP web service — its operations, the messages and data types they exchange, and the endpoints and bindings. It is the machine-readable contract a client reads to know exactly how to call the service, so tooling can generate client stubs automatically.

JSON is lighter and maps directly to key-value objects and arrays, is native to JavaScript, and by default has no schema. XML is more verbose, uses nested tags with attributes and namespaces, supports comments, and can be validated against an XSD schema. SOAP services use XML; REST APIs most often use JSON.

The block breaks several JSON rules: an unquoted string value (73bf37d59d), a leading zero (01), a comma used as a decimal separator (20,5 must be 20.5), an unquoted key (title_font_style), a trailing comma after "mobile", and a missing closing } on the {type, title} object before its ]. Quoting "false" is legal but likely should be the boolean false.