---
description: Rest stands for Representational State Transfer. It is an architectural style and an approach for communication used in the development of Web Services. REST has become a logical choice for building A
title: REST API Testing Tutorial: Sample Manual Test Cases
image: https://www.guru99.com/images/rest-api-testing-tutorial.png
---

 

[Skip to content](#main) 

**⚡ Smart Summary**

REST API Testing validates RESTful web services by sending HTTP requests such as GET, POST, PUT, and DELETE, then verifying the status code, response headers, and payload returned by the server.

* 🔑 **Core Idea:** Exercise the service layer directly, with no user interface in between.
* 🔁 **Method Coverage:** Drive GET, POST, PUT, and DELETE against every exposed resource.
* 🛠️ **Client Setup:** Install Advanced Rest Client before you send the very first request.
* 📋 **Request Build:** Supply the endpoint URL, method, headers, parameters, and JSON payload.
* ✅ **Response Checks:** Confirm the response code, response message, and response body all match expectations.
* 🔐 **Security Depth:** Replay calls with missing, expired, and low-privilege tokens to force 401 and 403 replies.
* 🤖 **AI Support:** Machine learning drafts edge-case payloads that manual testers routinely overlook.

[ Read More ](javascript:void%280%29;) 

![](https://www.guru99.com/images/rest-api-testing-tutorial.png)

## What is REST API Testing?

**REST API Testing** is an open-source web automation testing technique that is used for testing RESTful APIs for web applications. The purpose of REST API testing is to record the response of the REST API by sending various HTTP/S requests to check if the REST API is working fine or not. REST API testing is done by GET, POST, PUT and DELETE methods.

[REST](https://www.guru99.com/restful-web-services.html) stands for Representational State Transfer. It is an architectural style and an approach for communication used in the development of [Web Services](https://www.guru99.com/web-services-tutorial.html). REST has become a logical choice for building APIs, because it enables users to connect and interact with cloud services efficiently.

An API, or Application Programming Interface, is a set of programming instructions for accessing a web-based software application. In other words, it is a set of commands used by one program to communicate with another directly and use each other’s functions to get information.

For example, a Google website can have an API for search, translations, and calendars. In general, APIs look like the example below, with a server name, paths, and parameters.

http://<server name>/v1/export/Publisher/Standard_Publisher_Report?format=csv

But why invest testing effort at this layer at all?

## Why REST API Testing Matters

A REST API sits between the user interface and the database, which makes it the layer where most business logic actually lives. A defect in a pricing rule or a permission check surfaces in the API response long before anyone spots a wrong number on a screen, so testing here catches problems earlier and closer to their cause.

Speed is the second reason. A request completes in milliseconds and needs no browser, no rendering engine, and no fragile element locators. A tester can exercise dozens of endpoints in the time one interface test takes to load a page, and the same request behaves identically whether the front end is a website, a mobile app, or a partner integration.

Stability is the third reason. Layouts change constantly, but a published REST contract is expected to stay steady. Tests written against that contract survive redesigns, so they protect the parts of the product that other teams actually build on.

## Types of API Methods

There are mainly 4 types of [API Testing](https://www.guru99.com/api-testing.html) methods: GET, POST, DELETE, and PUT.

* **GET**– The GET method is used to extract information from the given server using a given URI. While using a GET request, it should only extract data and should have no other effect on the data.
* **POST**– A POST request is used to create a new entity. It can also be used to send data to the server, for example, customer information, file upload, etc. using HTML forms.
* **PUT**– Create a new entity or update an existing one.
* **DELETE**– Removes all current representations of the target resource given by a URI.

## How to Test REST API

REST API testing requires an application to interact with a sample API for testing. To test an API, you require two things:

* Testing Tool/Framework to drive the API
* Writing down your own code to test the sample REST API

REST API test cases can be tested with tools like:

* Advanced Rest Client
* Postman-Rest Client
* Curl in Linux

Here we will be using Advanced Rest Client. Below are the steps to get Advanced Rest Client.

## How to Get Advanced Rest Client?

* Go to Google Chrome’s Web Store
* Search for “Advanced Rest Client” or directly go[ here ](https://install.advancedrestclient.com/)and Install the extension
* Select the “Advanced Rest Client” icon under chrome’s app section – chrome://apps/

The Web Store listing appears as shown below.

[![How to install Advance Rest Client](https://www.guru99.com/images/1/Advance_Rest_Client.png)](https://www.guru99.com/images/1/Advance%5FRest%5FClient.png)

Once the installation is done, follow the test below for testing a [RESTful API](https://www.guru99.com/restful-web-services.html).

## Steps for Testing REST API

Here we are using the REST client extension in the Chrome browser. To understand it in a clear way, we are using a dummy API for testing:

http://ip.jsontest.com/

**Step 1) Open Advanced REST client**

Launch the app Advanced REST client (ARC), once it is installed successfully.

[![Open Advanced REST client](https://www.guru99.com/images/1/081419_0518_StepsforTes1.jpg)](https://www.guru99.com/images/1/081419%5F0518%5FStepsforTes1.jpg)

**Step 2) Enter the URL of API to test**

Enter the sample REST API URL for testing in the URL textbox.

[![URL of API to test](https://www.guru99.com/images/1/081419_0518_StepsforTes2.png)](https://www.guru99.com/images/1/081419%5F0518%5FStepsforTes2.png)

**Step 3) Select the HTTP method**

Select the method for the type of HTTP methods in API testing to hit- e.g. POST

[![HTTP Method](https://www.guru99.com/images/1/081419_0518_StepsforTes3.png)](https://www.guru99.com/images/1/081419%5F0518%5FStepsforTes3.png)

**Step 4) Provide Headers set**

Provide Headers Set, in the Headers textbox. Click on Insert header set.

[![Headers Set](https://www.guru99.com/images/1/081419_0518_StepsforTes4.png)](https://www.guru99.com/images/1/081419%5F0518%5FStepsforTes4.png)

**Step 5) Confirm the Headers set**

Next Click on USE THIS SET.

[![Headers Set](https://www.guru99.com/images/1/081419_0518_StepsforTes5.png)](https://www.guru99.com/images/1/081419%5F0518%5FStepsforTes5.png)

**Step 6) Provide required Body content**

1. Now switch to Body Tab.
2. Set the required Body content type and Editor view e.g. Body content type : application/json
3. Editor view : Raw input.
4. Under Payload, pass the request body of the demo API for testing in the form of key-value pairs, for example {“key1″:”value1″,”key2″:”value2”}. If it is a POST API, then we need to pass a body or parameters. We will pass it under the given payload.

{"property" : ["Sites"], "report_type" : ["ALL"]}

[![Steps for Testing REST API](https://www.guru99.com/images/1/081419_0518_StepsforTes6.png)](https://www.guru99.com/images/1/081419%5F0518%5FStepsforTes6.png)

**⚠️ Warning:** A Content-Type of application/json with a payload that is not valid [JSON](https://www.guru99.com/json-tutorial.html) returns 400 Bad Request.

**Step 7) Submit the details to start the test**

1. Hit the send button.
2. You can click on DETAILS button to see the Response headers.

[![Steps for Testing REST API](https://www.guru99.com/images/1/081419_0518_StepsforTes7.png)](https://www.guru99.com/images/1/081419%5F0518%5FStepsforTes7.png)

Here are the response details:

[![Steps for Testing REST API](https://www.guru99.com/images/1/081419_0518_StepsforTes8.png)](https://www.guru99.com/images/1/081419%5F0518%5FStepsforTes8.png)

The response still has to be judged against an expected result.

### RELATED ARTICLES

* [What is Software Testing? ](https://www.guru99.com/software-testing-introduction-importance.html "What is Software Testing?")
* [18 Best Software Testing Tools Reviewed in 2026 ](https://www.guru99.com/testing-tools.html "18 Best Software Testing Tools Reviewed in 2026")
* [Agile Testing: Methodology & Life Cycle ](https://www.guru99.com/agile-testing-a-beginner-s-guide.html "Agile Testing: Methodology & Life Cycle")
* [Testing Retail Point of Sale (POS) Systems ](https://www.guru99.com/testing-for-retail-pos-point-of-sale-system.html "Testing Retail Point of Sale (POS) Systems")

## Validating the Results

Mainly, for Web API Testing, we need to check the response code, the response message, and the response body.

Response codes fall into five families:

| Family | Category      | Meaning                         |
| ------ | ------------- | ------------------------------- |
| 1xx    | Informational | Received, still processing      |
| 2xx    | Success       | Completed; 200 OK, 201 Created  |
| 3xx    | Redirection   | A further action is required    |
| 4xx    | Client Error  | Bad payload, token, or resource |
| 5xx    | Server Error  | Valid request, server failed    |

Below are the response codes one might encounter.

[![Validating the Results](https://www.guru99.com/images/4-2016/040516_0528_TestingREST7.png)](https://www.guru99.com/images/4-2016/040516%5F0528%5FTestingREST7.png)

One request proves the endpoint works. A suite proves it keeps working.

## REST API Test Cases You Must Cover

A useful REST API suite spreads across several categories instead of repeating the same happy-path call with different data:

* **Happy path:** Send a valid request to each endpoint and confirm the status code, the schema, and every field value.
* **Negative cases:** Send malformed JSON, an unsupported method, and a missing resource ID, then expect 400, 405, and 404 rather than 500.
* **Boundary values:** If a field accepts 1 to 200 characters, test 0, 1, 200, and 201\. Validation rules break at the edges.
* **Special characters:** Push accented letters, emoji, quotes, and multi-byte text through every field to expose encoding faults.
* **Contract checks:** Compare the response against the published OpenAPI or Swagger specification so undocumented changes are caught early.
* **Sequencing:** Call endpoints in a realistic order, such as POST then GET then DELETE, because state carries between calls.
* **Performance sanity:** Record response times on every run and flag any endpoint that drifts past the threshold agreed with the team.

## REST API Test Tool

Different tools suit different stages of testing.

| Tool                                                     | Type               | Best for                        |
| -------------------------------------------------------- | ------------------ | ------------------------------- |
| Advanced Rest Client                                     | Desktop client     | Quick manual calls              |
| [Postman](https://www.guru99.com/postman-tutorial.html)  | Desktop client     | Collections and team workspaces |
| [JMeter](https://www.guru99.com/jmeter-tutorials.html)   | Load testing       | Response times under load       |
| [SoapUI](https://www.guru99.com/soapui-tutorial.html)    | Functional testing | REST and SOAP together          |
| [REST Assured](https://www.guru99.com/rest-assured.html) | Java library       | Automating stable cases         |
| cURL                                                     | Command line       | Pasting calls into bug reports  |

See the roundup of [API testing tools](https://www.guru99.com/top-6-api-testing-tool.html).

Most real endpoints refuse to answer until the request proves who sent it.

## REST API Authentication and Security Checks

Public demo endpoints answer anyone, but a production REST API sits behind an authentication scheme, and an authorisation flaw is far more damaging than a wrong field value. First identify the mechanism: a static API key, HTTP Basic credentials, an OAuth 2.0 bearer token, or a signed JSON Web Token.

Once an authenticated request succeeds, work through the failure paths deliberately:

1. **No credentials:** remove the Authorization header. Expect 401 Unauthorized and no record data in the body.
2. **Malformed credentials:** corrupt one character of the token. Expect 401 again, with a message that does not explain why.
3. **Expired credentials:** reuse a token past its expiry. Confirm it is rejected rather than honoured, a common clock-skew defect.
4. **Wrong privilege level:** authenticate as a low-privilege user and call an administrator-only endpoint. Expect 403 Forbidden, not 200.
5. **Another user’s record:** change the ID so user A requests user B’s data. Success here is a serious access-control defect.

Finally, confirm every call travels over HTTPS, that failed responses leak no stack traces or version banners, and that rapid repeats trigger 429 Too Many Requests.

REST API testing also brings difficulties that interface testing does not.

## Challenges for API Testing

The interesting problems for testers while REST API testing are:

1. To make sure that the test harness varies the parameters of the API calls in such a way that it verifies the functionality as well as exposes the failures. It includes exploring boundary conditions and assigning common parameters
2. Creating interesting parameter value combinations for calls with two or more parameters
3. Identifying the content under which the API calls have to be made. This might include setting external environment conditions (peripheral devices, files, etc.) as well as internally stored data that affects the API
4. Sequencing API calls as per the order in which the function will be executed
5. To make the API produce useful results from successive calls.

## FAQs

🔄 What is the difference between REST API testing and SOAP API testing?

REST testing works with lightweight JSON or XML over plain HTTP verbs. SOAP testing validates a strict XML envelope against a WSDL contract, so it needs a schema-aware client such as [SoapUI](https://www.guru99.com/soapui-tutorial.html) rather than a simple REST client.

💻 Do you need coding knowledge to test a REST API manually?

No. Clients such as Advanced Rest Client and [Postman](https://www.guru99.com/postman-tutorial.html) let you build a request through a form. Coding becomes necessary only when you automate the same cases with a library such as [REST Assured](https://www.guru99.com/rest-assured.html).

⏱️ What is an acceptable REST API response time?

Most teams treat under 300 milliseconds as good and under one second as acceptable for a single read. Anything past a few seconds harms the calling application, so record timings every run and raise a defect on drift.

🤖 How does AI help with REST API testing?

AI reads an OpenAPI specification and generates request payloads, including boundary and malformed variants that testers commonly miss. It also clusters similar failures and highlights endpoints whose recent changes make them likely to break.

🧠 Can AI replace manual REST API testers?

No. AI does not know what the business considers correct, which access rules matter, or which data is sensitive. It scales case generation, while a tester still decides what a valid response actually means.

#### Summarize this post with:

ChatGPT Perplexity Grok Google AI 

**Stay Updated on AI** **Get Weekly AI Skills, Trends, Actionable Advice.** 

##### Sign up for the newsletter

Subscribe for Free 

You have successfully subscribed.  
Please check your inbox. 

![AI-Newsletter](https://www.guru99.com/images/footer-email-avatar-imges-1.png) Chosen by over **350,000+** professionals 

[Scroll to top ](#wrapper)Scroll to top 

× 

Toggle Menu Close 

Search for: 

Search

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.guru99.com/#organization","name":"Guru99","sameAs":["https://www.facebook.com/Guru99Official","https://twitter.com/guru99com"],"logo":{"@type":"ImageObject","@id":"https://www.guru99.com/#logo","url":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","contentUrl":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","caption":"Guru99","inLanguage":"en-US"}},{"@type":"WebSite","@id":"https://www.guru99.com/#website","url":"https://www.guru99.com","name":"Guru99","publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https://www.guru99.com/images/rest-api-testing-tutorial.png","url":"https://www.guru99.com/images/rest-api-testing-tutorial.png","width":"700","height":"250","caption":"REST API Testing Tutorial","inLanguage":"en-US"},{"@type":"BreadcrumbList","@id":"https://www.guru99.com/testing-rest-api-manually.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":"1","item":{"@id":"https://www.guru99.com","name":"Home"}},{"@type":"ListItem","position":"2","item":{"@id":"https://www.guru99.com/softwaretesting","name":"Software Testing"}},{"@type":"ListItem","position":"3","item":{"@id":"https://www.guru99.com/testing-rest-api-manually.html","name":"REST API Testing Tutorial: Sample Manual Test Cases"}}]},{"@type":"WebPage","@id":"https://www.guru99.com/testing-rest-api-manually.html#webpage","url":"https://www.guru99.com/testing-rest-api-manually.html","name":"REST API Testing Tutorial: Sample Manual Test Cases","dateModified":"2026-07-28T17:54:33+05:30","isPartOf":{"@id":"https://www.guru99.com/#website"},"primaryImageOfPage":{"@id":"https://www.guru99.com/images/rest-api-testing-tutorial.png"},"inLanguage":"en-US","breadcrumb":{"@id":"https://www.guru99.com/testing-rest-api-manually.html#breadcrumb"}},{"@type":"Person","@id":"https://www.guru99.com/author/thomas","name":"Thomas Hamilton","description":"I am Thomas Hamilton, a seasoned professional in software testing, specializing in crafting comprehensive guides to help you master your software testing skills.","url":"https://www.guru99.com/author/thomas","image":{"@type":"ImageObject","@id":"https://www.guru99.com/images/thomas-hamilton-author-v2-120x120.png","url":"https://www.guru99.com/images/thomas-hamilton-author-v2-120x120.png","caption":"Thomas Hamilton","inLanguage":"en-US"},"worksFor":{"@id":"https://www.guru99.com/#organization"}},{"articleSection":"Software Testing","headline":"REST API Testing Tutorial: Sample Manual Test Cases","description":"Rest stands for Representational State Transfer. It is an architectural style and an approach for communication used in the development of Web Services. REST has become a logical choice for building A","keywords":"testing","speakable":{"@type":"SpeakableSpecification","cssSelector":[".entry-title",".summary"]},"@type":"Article","author":{"@id":"https://www.guru99.com/author/thomas","name":"Thomas Hamilton"},"dateModified":"2026-07-28T17:54:33+05:30","image":{"@id":"https://www.guru99.com/images/rest-api-testing-tutorial.png"},"copyrightYear":"2026","name":"REST API Testing Tutorial: Sample Manual Test Cases","subjectOf":[{"@type":"HowTo","name":"How to Test REST API?","description":"Let's take a look at an example of how to test REST API","step":[{"@type":"HowToStep","name":"Step 1) Open Advanced REST client","text":"Launch the app Advanced REST client (ARC), once it is installed successfully.","image":{"@type":"ImageObject","url":"https://cdn.guru99.com/images/1/081419_0518_StepsforTes1.jpg"},"url":"https://www.guru99.com/testing-rest-api-manually.html#step1"},{"@type":"HowToStep","name":"Step 2) Enter the URL of API to test:","text":"Enter the sample REST API URL for testing in the URL textbox.","image":{"@type":"ImageObject","url":"https://cdn.guru99.com/images/1/081419_0518_StepsforTes2.png"},"url":"https://www.guru99.com/testing-rest-api-manually.html#step2"},{"@type":"HowToStep","name":"Step 3) Select the HTTP method","text":"Select the method for the type of HTTP methods in API testing to hit- e.g. POST","image":{"@type":"ImageObject","url":"https://cdn.guru99.com/images/1/081419_0518_StepsforTes3.png"},"url":"https://www.guru99.com/testing-rest-api-manually.html#step3"},{"@type":"HowToStep","name":"Step 4) Provide Headers set","text":"Provide Headers Set, in the Headers textbox. Click on Insert header set.","image":{"@type":"ImageObject","url":"https://cdn.guru99.com/images/1/081419_0518_StepsforTes4.png"},"url":"https://www.guru99.com/testing-rest-api-manually.html#step4"},{"@type":"HowToStep","name":"Step 5) Confirm the Headers set","text":"Next Click on USE THIS SET.","image":{"@type":"ImageObject","url":"https://cdn.guru99.com/images/1/081419_0518_StepsforTes5.png"},"url":"https://www.guru99.com/testing-rest-api-manually.html#step5"},{"@type":"HowToStep","name":"Step 6) Provide required Body content","text":"Now switch to Body Tab.","image":{"@type":"ImageObject","url":"https://cdn.guru99.com/images/1/081419_0518_StepsforTes6.png"},"url":"https://www.guru99.com/testing-rest-api-manually.html#step6"},{"@type":"HowToStep","name":"Step 7) Submit the details to start the test","text":"Hit the send button, and now You can click on DETAILS button to see the Response headers.","image":{"@type":"ImageObject","url":"https://cdn.guru99.com/images/1/081419_0518_StepsforTes7.png"},"url":"https://www.guru99.com/testing-rest-api-manually.html#step7"}]},{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is the difference between REST API testing and SOAP API testing?","acceptedAnswer":{"@type":"Answer","text":"REST testing works with lightweight JSON or XML over plain HTTP verbs. SOAP testing validates a strict XML envelope against a WSDL contract, so it needs a schema-aware client such as SoapUI rather than a simple REST client."}},{"@type":"Question","name":"Do you need coding knowledge to test a REST API manually?","acceptedAnswer":{"@type":"Answer","text":"No. Clients such as Advanced Rest Client and Postman let you build a request through a form. Coding becomes necessary only when you automate the same cases with a library such as REST Assured."}},{"@type":"Question","name":"What is an acceptable REST API response time?","acceptedAnswer":{"@type":"Answer","text":"Most teams treat under 300 milliseconds as good and under one second as acceptable for a single read. Anything past a few seconds harms the calling application, so record timings every run and raise a defect on drift."}},{"@type":"Question","name":"How does AI help with REST API testing?","acceptedAnswer":{"@type":"Answer","text":"AI reads an OpenAPI specification and generates request payloads, including boundary and malformed variants that testers commonly miss. It also clusters similar failures and highlights endpoints whose recent changes make them likely to break."}},{"@type":"Question","name":"Can AI replace manual REST API testers?","acceptedAnswer":{"@type":"Answer","text":"No. AI does not know what the business considers correct, which access rules matter, or which data is sensitive. It scales case generation, while a tester still decides what a valid response actually means."}}]}],"@id":"https://www.guru99.com/testing-rest-api-manually.html#schema-21801","isPartOf":{"@id":"https://www.guru99.com/testing-rest-api-manually.html#webpage"},"publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US","mainEntityOfPage":{"@id":"https://www.guru99.com/testing-rest-api-manually.html#webpage"}}]}
```