Learn / Cheat sheet
HTTP Cheat Sheet for API Testing
What a tester needs from HTTP on one sheet: which methods are safe and idempotent, which status code each situation should return, the headers worth asserting on, the cURL flags you’ll use daily, and a checklist for each response.
Checked against HTTP semantics per RFC 9110; Problem Details per RFC 9457
Methods
| Method | Use | Safe | Idempotent |
|---|---|---|---|
GET | Read a resource or collection | Yes | Yes |
HEAD | Like GET, headers only | Yes | Yes |
OPTIONS | Allowed methods; CORS preflight | Yes | Yes |
POST | Create, or run an action | No | No |
PUT | Replace the whole resource | No | Yes |
PATCH | Change some fields | No | Not guaranteed |
DELETE | Remove a resource | No | Yes |
Idempotent means repeating the request leaves the server in the same state. The response can differ: a second DELETE may return 404.
Status codes to assert
| Code | Meaning | Typical test |
|---|---|---|
200 OK | Success with a body | GET an existing resource |
201 Created | Resource created | POST valid data; check the Location header |
204 No Content | Success, empty body | DELETE, or PUT that returns nothing |
301 / 308 | Moved permanently | Old URL redirects; 308 keeps the method |
304 Not Modified | Cached copy is still valid | GET with If-None-Match: <etag> |
400 Bad Request | Malformed request | Invalid JSON, wrong types |
401 Unauthorized | Not authenticated | Missing or expired token |
403 Forbidden | Authenticated, not allowed | Access another user's resource |
404 Not Found | No such resource | Unknown id (or hiding one you may not see) |
405 Method Not Allowed | Wrong method for this URL | DELETE on a read-only endpoint |
409 Conflict | Clashes with current state | Duplicate email, stale version |
415 Unsupported Media Type | Body format not accepted | Send text/plain to a JSON endpoint |
422 Unprocessable Content | Valid JSON, invalid values | Business-rule validation errors |
429 Too Many Requests | Rate limited | Burst of requests; check Retry-After |
500 Internal Server Error | Server bug | Never expected: always a defect |
502 / 503 / 504 | Upstream failure, unavailable, timeout | Dependency down; check retries |
Headers worth checking
| Header | Example | Why |
|---|---|---|
Content-Type | application/json; charset=utf-8 | Response format matches the body |
Accept | application/json | Client asks for a format; expect 406 if unsupported |
Authorization | Bearer eyJhbGciOi… | Token auth; missing → 401 |
Location | /api/orders/1043 | Set on 201 Created and redirects |
Cache-Control | no-store | Personal or sensitive data must not be cached |
ETag / If-None-Match | "a1b2c3" | Conditional GET → 304 |
Retry-After | 30 | Sent with 429 or 503 |
Set-Cookie | sid=…; HttpOnly; Secure; SameSite=Lax | Session cookies need HttpOnly and Secure |
Access-Control-Allow-Origin | https://app.example.com | CORS: never * for credentialed requests |
cURL
| Task | Code |
|---|---|
| Show status and headers | curl -i https://api.example.com/users/1 |
| Full request/response trace | curl -v https://api.example.com/users/1 |
| POST JSON | curl -X POST https://api.example.com/users \
-H 'Content-Type: application/json' \
-d '{"email":"qa@example.com"}' |
| Bearer token | curl -H "Authorization: Bearer $TOKEN" https://api.example.com/me |
| Basic auth | curl -u user:pass https://api.example.com/admin |
| Follow redirects | curl -L https://example.com/old |
| Only the status code | curl -s -o /dev/null -w '%{http_code}' https://api.example.com/health |
| Fail on 4xx/5xx in scripts | curl --fail-with-body https://api.example.com/health |
On Windows cmd, swap the single quotes for double quotes and escape inner ones.
Checklist for every response
| Check | Example |
|---|---|
| Status code | Exactly 201, not "any 2xx" |
| Body schema | Required fields present, correct types, no extra sensitive fields |
| Values | Echoed input matches; computed fields (totals, dates) are right |
| Headers | Content-Type, Location, Cache-Control |
| Error shape | Consistent error format (e.g. RFC 9457 problem details) with a useful message |
| Side effects | The record exists, or doesn’t, when you GET it back |
| Response time | Within the agreed budget |