Pragmatic Tools for Manual API Testing

As a web application test engineer, you need to test backend (APIs) as easily as frontend (UI in a browser).

Dozens of articles appear every year that tell about «the best tools for API testing», including Swagger (which is a tool for documentation and should be implemented by developers), REST Assured (which is a DSL for Java projects and requires programming skills), JMeter (which is a tool for load testing) and other frameworks for automation testing — that is a total mess of approaches and technologies.

I will focus only on tools for functional testing of HTTP/HTTPS REST APIs.

There are several types of tools for testing API by manual testers — from the simplest to the text-based:

• Browsers
• GUI: Postman, Insomnia, Paw, Hoppscotch and TestMace
• CLI: cURL and HTTPie
• VS Code: REST Client and Thunder Client

For all examples, I used the latest versions of the apps for macOS Big Sur and OpenWeather API handler: https://api.openweathermap.org/data/2.5/onecall?lat=40.1811&lon=44.5136&appid={api_key}

Browsers

As strange as it may sound, a web browser is the very first tool to start API testing. You can only stop at this tool and test almost everything from DevTools, but it is not too handy.

The browser is best suited for ad hoc checking GET requests. You just need to insert the URI in the address bar. This method is suitable for manual testing of parameters in the query string or testing the correctness of the incoming response — in most cases, in JSON format.

Firefox has a built-in JSON viewer with syntax highlighting and a search filter:

Fig. 1. Firefox JSON viewer

«Raw Data» tab shows an unformatted body as it is, and «Pretty Print» option converts plain text into a readable form — very convenient for copying:

Fig. 2. Firefox «Raw Data» «Pretty Print» JSON viewer

Chromium-based browsers do not provide JSON viewer out of the box (despite that a primitive viewer in DevTools «Network» tab):

Fig. 3 & 4. Chrome preview

For a nice look at JSON output, you had to install extensions: JSON Viewer or JSONVue.

Fig. 5. Chrome with JSON Viewer extension

If the API has authorization through cookies (Cookie headers), the browser will automatically path your cookie to a single GET request in the new tab. So, you can test API responses for unauthorized requests by using a Private (Incognito) window.

Even if browsers give enough room for API testing, the use of specialized tools (which will be discussed above) gives more flexibility to work with the API.

GUI

Postman

Today Postman is the most popular tool for API testing. Starting from a browser extension, it has become an extremely powerful desktop application for all platforms: Windows, Mac OS, and Linux. There is no reason to talk about its features here because all of them are repeatedly covered in many articles, videos, talks, and even courses.

Despite the ongoing promotion of its cloud platform, the app continues to provide for free its main and perfectly working function — issue HTTP requests to an HTTP API.

Fig. 6. Postman

Insomnia

Insomnia is a worthy alternative to Postman. It is open source, free, has almost the same set of features, more interface themes, and supports plugins that extend the standard functionality.

If you are an inexperienced user in API testing or you are overwhelmed with Postman’s features that you do not need — Insomnia is your choice. Advanced Postman’s users may face the absence of some of their usual things, but comparison is not a topic of this article.

Fig. 7. Insomnia

Further reading:

• Using Insomnia for API exploration
• API Testing with Insomnia
• How to use Insomnia to Test API Endpoints
• Understanding Insomnia REST Client Made Easy 101
• Postman vs. Insomnia: Comparing the API Testing Tools

Paw

Paw is a powerful API client for Mac users. Since Paw is a native application, it is compact and has macOS graphical user interface. It loads and parses JSON faster than Postman and Insomnia, but it is gorgeously better exactly for 50$.

Fig. 8. Paw

Further reading:

• Introducing Paw, an HTTP client and API tool for developers
• Paw Tutorial
• Insomnia vs. Postman vs. Paw: Comparing the Top API Clients

Hoppscotch

Hoppscotch (previously known as Postwoman) is a web online API request builder. It means that you do not need to install any desktop application — it is an app inside your browser and can be used on mobile devices. It is open source, free, simple and has a familiar Postman-like interface.

Fig. 9. Hoppscotch

Hoppscotch is a full-fledged web application that requests API directly via browser without any third-party layers. It means you can safely request your company’s internal API inside VPN.

Fig. 10. Hoppscotch does not issue unwanted requests (proof from Firefox DevTools)

Further reading:

• Api Testing with Hoppscotch
• How to Test with Hoppscotch
• Learn API basics with Hoppscotch

TestMace

TestMace is an IDE for API (as developers call it). It is yet another web app inside Electron’s wrapper as Postman and Insomnia. Unfortunately, I have not found any advantages over competitors (besides, the interface is quite buggy), and I included this tool in the list only because such a thing exists and is under development.

Fig. 11. TestMace

CLI

сURL

сURL is a command-line tool for transferring data through various network protocols, including HTTP — exactly what we need for REST API testing. By using cURL you can isolate your requests from the limitations and influences of the frontend environment and generate requests of any complexity that cannot be reproduced in any GUI client.

Fig. 12. cURL in Terminal

cURL has a fairly clear syntax for composing requests: -X for request method, -H for headers, and -d for body and other options.

My top cURL options:

• -i — show response headers in the output;
• -k — skip certificate verification;
• -l — follow redirects;
• -m — set timeout;
• -v — show the whole HTTP exchange (verbose mode, perfect for serious debugging).

The advantage of cURL is that you can get cURL’s request straight ahead from any browser by «Copy as cURL» in a resource’s menu or by code snippet in Postman.

Fig. 13. «Copy as cURL» from Firefox DevTools

Fig. 14. cURL code snippet in Postman

The next advantage of the console utility is that it could be combined with other Unix commands. In the example below, I used time to determine the duration of the request and hid output by redirecting stdout to /dev/null:

time curl -s https://api.openweathermap.org/data/2.5/onecall?lat=40.1811&lon=44.5136&appid={api_key} > /dev/null

Fig. 15. time curl -s

The only difficulty with cURL is that it does not show JSON from the body in a pretty way. Therefore, you have to use additional tools to parse the response.

Further reading:

• How to test a REST API from command line with curl
• How to use curl to test a REST API
• Testing Endpoints With Curl

By the way, if your API responds with files or you have to test files downloading, then you probably should use Wget instead of cURL.

HTTPie

HTTPie is a fancy command-line HTTP tool. It is promoted as an API testing tool, focused only on HTTP protocol, and has built-in JSON support. The request syntax is easy (but differs from cURL), and you do not need to have any special skills to start using it.

Fig. 16. Httpie in Terminal with verbose output

The developers are preparing a desktop version of HTTPie, which is currently in private beta.

Further reading:

• HTTPie: human-friendly CLI HTTP client for the API era
• API Testing with HTTPie

Visual Studio Code

REST Client

Some IDEs have integrated tools for debugging HTTP. For example, Visual Studio Code has a REST Client extension which allows sending HTTP requests and viewing the response directly from the editor. It supports HTTP syntax and cURL commands.

Once you have prepared the HTTP request, you should evoke the command palette (CMD/CTRL + Shift + P) and choose «Rest Client: Send Request» — the response will open on the next tab:

Fig. 17. VS Code Rest Client extension

Thunder Client

If you do not want to type the requests, you can compose them directly from Visual Studio Code in a GUI way through Thunder Client. It is very handy to have a Postman-like interface and not to leave your code editor for making HTTP requests.

Thunder Client is a lightweight extension with a limited set of functions, but all of them are exactly what you need for testing. It is also full of neat picky details like full screen mode, opening JSON response in a new tab, and even collections and environments as in a big app.

Fig. 18. VS Code Thunder Client extension

A «Tests» tab is especially good — it consists of presets of the most useful checks:

Fig. 19. Thunder Client tests

Further reading:

• Thunder Client — lightweight alternative to Postman
• Thunder Client — An Alternative Way to Test Restful APIs
• How to use Thunder Client for API testing?

I did not mention Soap UI (despite the name it works with REST APIs), which is quite popular in the enterprise sector, but I did not have a chance to use it. Because of this, I can not talk about what I did not touch with my own hands.