API testing is the testing of an API: it sends the API many requests, with many different inputs, and checks every answer against what the API should return. An API, or application programming interface, is a fixed set of requests that one program can send to another, with a fixed form for each answer. A mobile app gets almost all its data from a server through APIs. So if an API answers wrongly, every screen built on it shows something wrong.
API tests do not use a screen at all. The test sends a request directly to the server and reads the answer. This makes them fast: thousands can run in a few minutes. They also catch problems that screen tests miss, because a screen may hide a wrong answer.
What must an answer match? Many teams describe their APIs in the OpenAPI specification, a standard document that lists each request, the inputs it accepts and the answers it returns. API testing tools read this document and generate tests from it. They check four things. The first is the status code, a number that says whether the request succeeded, such as 201 for "created" or 400 for "bad input". The second is the shape of the answer, meaning its fields and their types. The third is the values. The fourth is the response time.
Consider a state government's scholarship portal, built by an IT services company in Bhubaneswar. Students apply through a website and a mobile app. Both send each application to the same API request, which creates the application. The OpenAPI description says that this request needs a name, a 12-digit Aadhaar number, a course code and the family income, and that it returns an application number. The testing tool sends 300 versions of this request. Valid applications must return status 201 and a new application number. An Aadhaar number with 11 digits must return 400, with a clear error message. A name of 5,000 characters must be refused, not stored. Each answer must arrive in under 500 milliseconds. The run finds two problems: a negative family income is accepted, and one error answer is missing a field that the description promises. Both are fixed before the portal opens for the new academic year.
APIs are usually designed and first tried in an API development platform, where the OpenAPI description is written. The API tests then run in the CI/CD pipeline on every change. So a change that breaks the agreed answers is stopped before release. The page on APIs explains how companies use them more widely. API testing checks that an API gives the right answers. Security testing of APIs is different: it looks for ways to misuse them, such as reading another student's application.