How do you find the right open-source API testing tool for your needs? Since my last roundup of the best candidates, a few more tools have appeared that warrant consideration—and there's a new technique that's all the buzz in AI automation circles that you need to know about.
While most vendors are talking up the benefits of AI- and UI-based testing tools in general, AI- and machine learning-based applications that help with API testing have arrived.
Before you begin API testing, however, make sure you understand test automation basics and know how to avoid the most common test automation mistakes.
Why perform API testing?
As more companies make the shift left toward DevOps, continuous integration (CI), and continuous deployment (CD), test feedback needs to be quicker than ever. Focusing solely on UI automation—which is notoriously slow—can kill your test automation efforts.
As you scramble to ensure that your applications are ready to ship, API testing should be part of your overall automation strategy.
APIs are the basis of modern software development, especially as more and more teams move away from monolithic applications and begin adopting a microservices approach to software development.
With microservices making up the backbone of most newer development efforts, API testing becomes even more critical than before.
Roadblocks to API testing adoption
Thinking that API testing was about to take off, I wrote a book about it back in 2014. It still hasn't taken off, though, for several reasons.
For one, even though many organizations claim to be agile, many still have distinct roles defined for developers and testers.
Testers believe developers should be doing API testing, while developers believe the opposite. Testers also may be technically unaware of how to even get started testing an API, so they simply focus on what they know—which is UI automation.
AI, machine learning can help
To reduce the complexity of API testing, some vendors have created utilities that leverage AI to convert manual UI tests into API tests.
These tools act like sniffers, using machine learning to automatically find patterns and connect relationships among different services as users interact with the applications.
As these approaches become more refined, you can imagine how the complexity of API test generation will be significantly reduced.
I've not seen this functionality available in any open-source API tools as yet, but don't let that prevent you from getting started. Knowing the basics of API testing will help you, both now and in an AI-driven API future.
The following are the top 11 API testing tools that can help you on your journey, with descriptions that should guide you in choosing the best fit for your needs.
REST-Assured
When using Java, REST-Assured is my first choice for API automation. In fact, it's the main tool I use for API testing.
REST-Assured is a fluent Java library you can use to test HTTP-based REST services. It's designed with testing in mind, and it integrates with any existing Java-based automation framework. The REST-Assured API was created so that you don't necessarily need to be an HTTP expert.
It provides a behavior-driven development (BDD)-like, domain-specific language that makes creating API testing in Java simple. It also has a bunch of baked-in functionalities, which means you don't have to code things from scratch.
Bonus: If you're like me and use the Serenity automation framework, you will like that REST-Assured integrates seamlessly with it, which means you can combine your UI and REST tests all in one framework that generates awesome reports.
Testing and validating REST services is harder in Java than it is in dynamic languages such as Ruby and Groovy. This is one more reason to use REST-Assured, since it brings the simplicity of using those languages into the Java domain.
If your team is made up mainly of Java coders, I highly recommend REST-Assured for API testing.
Postman
Some folks don't want to code in an integrated development environment using the same language as the developers. After all, if your developers don't contribute to your automation efforts, why force yourself to use their tech stack when it's not the best option for you?
Sometimes you just want a quick and dirty API test without all the overhead, or you need a tool to help with exploratory testing of your API. Postman is perfect in these scenarios. But it's also powerful enough that you can create more integrated solutions if you wish.
Postman is an easy-to-use REST client, and you can get started with it quickly by leveraging its Chrome plug-in. There are native versions for both Mac and Windows.
Postman has a rich interface that many REST clients don't have, making it easy to use. It also lets you easily share your knowledge with your co-workers, because you can package up all your requests and expected responses and send them off to someone else so that he or she can take a look.
Casual gaming company Big Fish Games uses Postman as a collaborative tool. According to Amber Race, a software development engineer in test (SDET) at the company, one person does the research and figures out all the test cases for the API.
That person then publishes that information to a wiki so that others can run the API tests and ensure that what they're doing doesn't break existing API functionality. Postman even allows you to place a button on your internal website saying, "Run in Postman," and it automatically kicks off your Postman tests.
If your team wants to not only test APIs but also have a tool to help automate some of your exploratory API testing efforts, Postman is a great choice.
Postwoman
Postwoman, an alternative to Postman, is a new tool that has gained in popularity over the past few months. It has a clean and modern UI that makes creating API requests fast and easy.
Features that Postwoman is known for include:
- The ability to run everything online (no install required)
- Support for multiple platforms and multiple devices
- The ability to access it from anywhere
- High customizability
If you need to start testing APIs and don’t want the hassle of having to install bloated software on your machine, this tool is for you. It has received almost 15,000 stars on GitHub, a good indicator that folks are getting value from it.
SoapUI
If your team has complicated API testing scenarios and is weighted toward QA/test engineers, SoapUI is the tool to try first—especially if the team does mostly API testing.
This fully functional test tool is completely dedicated to API testing, so why produce a solution from scratch? And if for some reason you need to create a custom workflow or functionality, you can code up your solution in SoapUI using Groovy.
JMeter
Although JMeter was created for load testing, many folks also use it for functional API testing.
JMeter includes all the functionality you need to test an API, plus extra features that can enhance your API testing efforts. For example, JMeter can automatically work with CSV files, so your teams can quickly produce unique parameter values for your API tests. It also integrates with Jenkins, so you can include your API tests in your CI pipelines.
If you plan to create API functional tests that you would also like to leverage in your performance tests, you can kill two birds with one stone by using JMeter as your main API testing system.
Karate
Karate, created by Intuit a few years ago, has matured into a stable tool with unique functionality. For example, it offers API testing, API testing doubles, and API performance testing all in one framework.
And with the its latest update, Karate also supports UI test automation—making it a true, end-to-end unified testing framework. It's constantly being updated, so be sure to check it out regularly to get up to speed on all the latest features.
Tests are written using a BDD, Gherkin-like syntax. But unlike most BDD frameworks (Cucumber, JBehave, SpecFlow), you don't need to write step definitions. Karate has already created all the step definitions you need to start testing APIs.
If you're new to programming or automation, Karate is easy to use, since you don't need any Java knowledge. If this is your situation, Karate might be the perfect choice.
Fiddler
Fiddler lets you monitor, manipulate, and reuse HTTP requests. It does many things that allow you to debug website issues, and, with one of its many extensions, you can accomplish even more.
One of those, the APITest extension, greatly validates the behavior of web APIs. (Validators offer a lightweight way to judge the success or failure of a test.) For more hard-core API testing development, use the FiddlerCore.NET class library to build your API testing infrastructure.
Fiddler is a great choice for teams that use .NET languages, since you can develop your tests using any .NET language you wish.
Citrus Framework
The Citrus Framework can help you automate integration tests for virtually any messaging protocol or data format.
Among its benefits:
- It works with REST, SOAP, HTTP, JMS, TCP/IP, and other protocols.
- It creates tests using Java or XML.
- It's mature; version 1 launched in September 2009, and it's been steadily updated ever since, with release 2.7.6 introduced in June 2019.
- It has great documentation.
If you plan to test other headless technologies beyond REST services, Citrus is the tool for you. It's made to handle any headless protocol, offering an excellent solution for all your non-UI testing needs. This flexibility is beneficial if you work in an enterprise environment and need to test many different kinds of applications.
PowerShell
You might be saying, "PowerShell? Really?" Yes. Really.
With the adoption of DevOps in Windows-based organizations, PowerShell is awesome at automating lots of things from the command line.
Some benefits of using PowerShell for API testing are:
- You need only one line of code to import your Web Services Description Language.
- You need only one line of code to send in your request and get your output.
- It comes factory-installed on all Windows machines, so it's available to all of your company's employees.
- It's easy to learn.
- It's very fast, since it runs from the command line without any UI overhead.
PowerShell is an open-source Microsoft product. So pretty much anytime you want to use the command line or automate anything, such as API tests inside the Windows ecosystem (or pretty much any Microsoft product), you should go with PowerShell.
Insomnia
After looking at Insomnia, I'm not sure how I ever missed it. It's free and easy to use, and it has a beautiful interface. Some other benefits of Insomnia are that it allows you to:
- Create HTTP requests
- View response details
- Organize your tests
- Reuse values
- Generate code snippets
There are even more features listed under the vendor's "big ol'" list of features on its website.
Taurus
Taurus is an automation-friendly framework for continuous testing. Because you can use it with JMeter, it can handle API testing.
The power of Taurus is that it allows you to write your tests in YAML, a human-readable and editable approach that lets you describe a test in a simple text file. You can actually describe a full-blown script in about 10 lines of text, which allows teams to describe their tests in either a YAML or JSON file.
YAML is a big leap forward from the old days of having to bring up a big, heavy, vendor-specific record and scripting tool.
Other features include:
- The tests are much more readable, and therefore easier to perform code reviews on, since your test cases are written in YAML.
- Taurus basically fits performance testing into your CI/CD pipeline much more efficiently.
- Taurus provides a sort of abstraction layer on top of JMeter, as well as some other tools such as Locust, Gatling, The Grinder, and Selenium.
Taurus is great to use when teams want to take a more BDD-based testing approach to their API testing efforts. Using YAML files gives you clear, easy-to-read tests that anyone on your team can understand.
Time to choose
There is no one perfect tool for everyone: Every organization has different requirements. Virtually all of the API test tools listed above work well and are great options. The key is to read through the descriptions carefully and decide which best fits your team's needs.
These tools are my picks, but they're just a small sampling of the open-source API testing tools out there. What are your favorites? Let me know what you think I should add next time—and why—in the comments below.
For more on API testing and other hot testing topics, attend AutomationGuild, Joe Colantonio's online conference for test automation pros. The conference, sponsored by TestGuild, takes place February 3-4. The $197 price includes access to all session recordings.
Keep learning
Take a deep dive into the state of quality with TechBeacon's Guide. Plus: Download the free World Quality Report 2022-23.
Put performance engineering into practice with these top 10 performance engineering techniques that work.
Find to tools you need with TechBeacon's Buyer's Guide for Selecting Software Test Automation Tools.
Discover best practices for reducing software defects with TechBeacon's Guide.
- Take your testing career to the next level. TechBeacon's Careers Topic Center provides expert advice to prepare you for your next move.
