Most of the API testing I am doing at this point is exploratory testing. Currently the area I’m working in does not have a lot of test automation on the APIs. We have developer level unit tests in place on the actual implementation of the APIs, but we don’t have many regression tests that run the APIs externally.
The tools I currently use for exploring APIs are largely a mixture of Postman and Python. I have used Postman to get in and figure out what an API looks like and the basics of what it can do. Then when I want to dive deeper and perhaps throw some interesting probes at it, I’ll dig in with the requests module in python. I also use Postman to document the API so that we have a shared references for what it can do and so that I have something to come back to when things are changing. One other thing I do is use Postman or SoapUI to make mock servers so that I can do front end testing of the components.
Python can also help with doing front end testing. For one of our components we have a bunch of static ‘demo’ data that we can use. Of course that data can become stale over time and so we need to occasionally refresh it. I use python to automate this process. It can make the request to the API to get the new data and then do the cleanup need to make it work as static files.
I have also experimented with a few other tools and hope to flesh out a bit more automation as we move forward, but for now that is my API testing tool set.