REST API guide

How to Test a REST API

A practical guide to testing REST endpoints with HTTP methods, headers, JSON request bodies, status codes, and response inspection.

Choose the HTTP method

Use GET to retrieve data, POST to create or submit it, PUT or PATCH to update it, and DELETE to remove it when the API supports that operation. Check the API documentation rather than assuming a route accepts every method.

Add the endpoint and headers

Enter the full HTTPS endpoint. Add headers such as Accept: application/json and Content-Type: application/json when required. Use test credentials and avoid exposing production secrets in shared screenshots or logs.

Prepare the request body

For POST, PUT, and PATCH requests, validate the JSON body before sending it. A malformed body commonly produces a 400 response before application logic is reached.

Interpret the response

• 2xx: the request succeeded.
• 400: inspect parameters and body syntax.
• 401 or 403: verify authentication and authorization.
• 404: confirm the route and resource identifier.
• 429: slow down or inspect rate-limit headers.
• 5xx: inspect the server and request correlation logs.

Understand browser CORS errors

A browser may block a valid API when the server does not allow the website origin. CORS is enforced by browsers, so compare the same request from a server or command line when diagnosing that failure.