REST API

A REST API exposes an application’s data as resources, such as /orders or /orders/42, and lets clients act on them with standard HTTP methods. REST (Representational State Transfer) is an architectural style rather than a standard, so real APIs follow it to varying degrees. The core ideas are resource-oriented URLs, meaningful use of HTTP methods and status codes, and stateless requests: each request carries everything the server needs, including authentication.

Example

Request	Meaning	Typical success
GET /orders?status=open	List open orders	200 OK
GET /orders/42	Read one order	200 OK
POST /orders	Create an order	201 Created + Location header
PUT /orders/42	Replace the order	200 OK or 204 No Content
PATCH /orders/42	Change some fields	200 OK
DELETE /orders/42	Delete the order	204 No Content

A test with REST Assured 5:

import static io.restassured.RestAssured.given;
import static org.hamcrest.Matchers.equalTo;

given()
    .baseUri("https://api.example.com")
    .header("Accept", "application/json")
.when()
    .get("/orders/42")
.then()
    .statusCode(200)
    .body("id", equalTo(42))
    .body("status", equalTo("open"));

What to test in a REST API

• Status codes for success and every failure path: missing auth, wrong role, invalid body, unknown id, conflicts.
• Response body and schema: field names, types, required fields, and that sensitive fields are not exposed.
• Headers: Content-Type, Location after a create, caching and CORS headers where relevant.
• Method semantics: GET has no side effects, PUT and DELETE are idempotent.
• Authorization at the object level: user A must not be able to read /orders/{id} belonging to user B.
• Pagination, filtering and sorting, including empty and last pages.

How it differs from other API styles

GraphQL usually exposes a single endpoint where the client describes the data it wants, and often returns 200 even when part of the query failed, so tests must inspect the errors field. SOAP uses XML envelopes and a formal WSDL contract. gRPC uses HTTP/2 and Protocol Buffers. A REST test suite leans heavily on HTTP itself, which is why HTTP fundamentals matter so much for API testers.