REST Assured structures a test in three parts: given() sets up the request (headers, params, body, auth), when() specifies the action (the HTTP method + endpoint), and then() validates the response.
This Behavior-Driven style makes tests self-documenting. given() is the arrange phase — base URI, headers, query/path params, request body, authentication. when() is the act phase — .get(), .post(), .put(), .delete() with the path. then() is the assert phase — .statusCode(), .body(...), .header(...), .time(...). You chain assertions in then(), and can add .extract() to pull values out for further use. The three keywords are static imports from io.restassured.RestAssured and the Hamcrest matchers, and while the given/when/then split is conventional, all three are technically optional.
A create-and-verify test: given().header('Authorization', token).contentType(JSON).body(payload).when().post('/orders').then().statusCode(201).body('status', equalTo('CREATED')).
Explain what each part of given().queryParam('id', 5).when().get('/user').then().statusCode(200) does.