The process of verifying that API requests are correctly processed and responses match expected format, content, and behavior.
Response validation is where most API testing effort goes. It's not enough to get a 200 status - you need to verify the response body is correct, data types are right, and database changes occurred. Comprehensive validation catches subtle bugs that would impact users.
| Point | Example |
|---|---|
| HTTP Status Codes | 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized |
| Response Body Structure | Required fields present, correct data types, proper nesting |
| Data Values | Response matches request, calculations are accurate |
| Response Time | Should respond within SLA (e.g., 500ms) |
| Error Messages | Clear, informative error messages for failures |
| Authorization | Users only see their own data |
Scenario: Your e-commerce API has a critical bug. When user A updates their profile (name, email, address), the response status is 200 OK and returns the updated data correctly. However, when user A queries their profile in a different request, they still see their old data. The database has the old data, not the new data. You have 1 hour to diagnose this bug. Walk through your testing and debugging approach.