API Testing

API Testing

Test REST API endpoints for correct behavior and responses.

What You Will Learn

• Core concepts and principles of API Testing
• How API Testing fits into the MERN backend stack
• Practical implementation patterns and best practices
• Common mistakes and how to avoid them

Prerequisites

Before diving into API Testing, make sure you understand the foundational concepts of Node.js and Express.js.

Why This Matters

Understanding API Testing is essential for building production-ready MERN backend applications. At Amazon, SDE-1 engineers are expected to implement these concepts correctly in backend services that handle millions of requests.

Key Concepts

API Testing is a fundamental building block in the MERN stack ecosystem. Mastering it enables you to build reliable, scalable backend systems.

Client Request
    |
    v
Express Router --> Middleware --> Controller --> Service --> Mongoose --> MongoDB
    |
    v
Response

Real-World Analogy

Think of API Testing like the foundation of a building. Just as a strong foundation supports the entire structure, understanding API Testing supports all the backend features you will build on top of it.

How API Testing Works

The Mechanism

API Testing operates as a core part of the MERN backend pipeline. Here is the flow:

1. Request arrives at the Express server
2. Middleware processes the request
3. Controller handles the business logic
4. Service layer interacts with the database
5. Response is sent back to the client

Request / Data Flow

HTTP Request
    |
    v
[Express Router] --> Route matching
    |
    v
[Middleware Chain] --> Authentication, Validation
    |
    v
[Controller] --> Request parsing, Response formatting
    |
    v
[Service] --> Business logic, Data transformation
    |
    v
[Repository/Mongoose] --> Database operations
    |
    v
[MongoDB] --> Data persistence
    |
    v
HTTP Response (JSON)

Visual Explanation

The MERN backend follows a layered architecture:

• Presentation Layer (Routes/Controllers): Handles HTTP requests and responses
• Business Logic Layer (Services): Implements application rules
• Data Access Layer (Repositories/Mongoose): Manages database interactions

Each layer has a single responsibility, making the code testable and maintainable.

Code Example

// Express route handler example
router.post('/api/users', validateRequest, async (req, res, next) => {
  try {
    const userData = req.body;
    const user = await userService.createUser(userData);
    res.status(201).json({ success: true, data: user });
  } catch (error) {
    next(error);
  }
});

Advantages

• Separation of concerns: Each layer handles one responsibility
• Testability: Layers can be tested independently
• Reusability: Services can be used across multiple controllers
• Maintainability: Changes in one layer do not affect others

Tradeoffs

• More files and folders to manage
• Initial setup takes longer than monolithic approaches
• Requires discipline to maintain proper layering

Implementing API Testing

Step-by-Step Guide

Step 1: Set up the project structure

src/
  controllers/
    userController.js
  services/
    userService.js
  models/
    User.js
  routes/
    userRoutes.js
  middleware/
    auth.js
    validate.js
  config/
    db.js
  app.js

Step 2: Define the model

const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
  name: { type: String, required: true },
  email: { type: String, required: true, unique: true },
  password: { type: String, required: true },
  role: { type: String, enum: ['user', 'admin'], default: 'user' }
}, { timestamps: true });

module.exports = mongoose.model('User', userSchema);

Step 3: Create the service

const User = require('../models/User');
const bcrypt = require('bcrypt');

class UserService {
  async createUser(userData) {
    const hashedPassword = await bcrypt.hash(userData.password, 10);
    const user = new User({ ...userData, password: hashedPassword });
    return user.save();
  }

  async findByEmail(email) {
    return User.findOne({ email });
  }
}

module.exports = new UserService();

Step 4: Create the controller

const userService = require('../services/userService');

exports.register = async (req, res, next) => {
  try {
    const existingUser = await userService.findByEmail(req.body.email);
    if (existingUser) {
      return res.status(409).json({ error: 'Email already registered' });
    }
    const user = await userService.createUser(req.body);
    res.status(201).json({ success: true, data: user });
  } catch (error) {
    next(error);
  }
};

Step 5: Define the route

const express = require('express');
const router = express.Router();
const userController = require('../controllers/userController');
const validate = require('../middleware/validate');

router.post('/register', validate(userSchema), userController.register);

module.exports = router;

JavaScript / TypeScript Example

// TypeScript version with interfaces
interface CreateUserDTO {
  name: string;
  email: string;
  password: string;
}

interface UserResponse {
  id: string;
  name: string;
  email: string;
  createdAt: Date;
}

async function createUser(dto: CreateUserDTO): Promise<UserResponse> {
  const hashedPassword = await bcrypt.hash(dto.password, 10);
  const user = await User.create({ ...dto, password: hashedPassword });
  return { id: user._id, name: user.name, email: user.email, createdAt: user.createdAt };
}

Common Mistakes

1. Putting business logic in controllers: Keep controllers thin
2. Skipping validation: Always validate input at the API boundary
3. Not handling errors: Always use try-catch or async error middleware
4. Hardcoding configuration: Use environment variables for all config

API Testing at Amazon

How Amazon Uses This

Amazon backend services rely heavily on the concepts covered in API Testing. As an SDE-1, you would:

• Build microservices that handle millions of requests per day
• Implement reliable APIs with proper error handling and validation
• Design for scalability and high availability
• Follow security best practices for data protection

Interview Relevance

In Amazon SDE-1 interviews, expect questions about:

1. Design: How would you design a backend service that uses API Testing?
2. Tradeoffs: What are the tradeoffs of different approaches?
3. Scalability: How would this scale to millions of users?
4. Debugging: How would you debug issues with API Testing in production?

STAR Method Example

Situation: Our team needed to implement API Testing for a new feature.
Task: I was responsible for designing and implementing the backend component.
Action: I used the layered architecture pattern with proper separation of concerns.
Result: The implementation handled 10K requests per second with 99.9% uptime.

Common Follow-up Questions

• How would you handle failures in this system?
• What monitoring would you add?
• How would you test this in staging before production?
• What would you do differently if starting over?