How it works

The explanation, with examples you can run.

What to check on every endpoint

Status codes that mean something: 201 with a Location header for a create, 400 for malformed input, 401 when there are no valid credentials, 403 when the caller is known but not allowed, 404 for a missing resource, 409 for a conflict such as a duplicate.
The body's shape: required fields are present and have the right types. Use a JSON Schema or the OpenAPI spec as the single source, so tests and documentation can't drift apart.
The effect: after a POST, the record exists. After a failed request, nothing changed.
Authorisation per object: try each endpoint as the owner, as another user, and with no token at all.

Idempotency and retries

Networks drop responses, and clients retry. GET, PUT and DELETE are idempotent by definition: repeating them leaves the server in the same state, even if the response changes (a second DELETE may return 404). POST is not, so APIs that take payments or create orders accept an idempotency key: a client-chosen id sent in a header, so the server can recognise a retry and replay the first result instead of acting again.

A tiny in-memory handler shows what a test should prove:

Your code

const orders = new Map()
const seenKeys = new Map()
let nextId = 1

function postOrder({ headers, body }) {
  if (!headers.authorization) return { status: 401 }
  if (typeof body.qty !== "number" || body.qty < 1) return { status: 400, body: { error: "qty must be 1 or more" } }
  const key = headers["idempotency-key"]
  if (key && seenKeys.has(key)) return seenKeys.get(key) // a retry: replay, don't repeat
  const order = { id: nextId++, sku: body.sku, qty: body.qty }
  orders.set(order.id, order)
  const response = { status: 201, body: order }
  if (key) seenKeys.set(key, response)
  return response
}
const hasShape = (obj, shape) => Object.entries(shape).every(([k, type]) => typeof obj?.[k] === type)

const auth = { authorization: "Bearer test-token" }
const first = postOrder({ headers: { ...auth, "idempotency-key": "k1" }, body: { sku: "MUG", qty: 2 } })
const retry = postOrder({ headers: { ...auth, "idempotency-key": "k1" }, body: { sku: "MUG", qty: 2 } })

console.log(first.status, retry.status, "same order:", first.body.id === retry.body.id, "orders stored:", orders.size)
console.log("shape ok:", hasShape(first.body, { id: "number", sku: "string", qty: "number" }))
console.log("no token:", postOrder({ headers: {}, body: { sku: "MUG", qty: 1 } }).status)
console.log("qty 0:", postOrder({ headers: auth, body: { sku: "MUG", qty: 0 } }).status)

⌘/Ctrl + Enter

OutputNot run yet

Press Run to see what your code prints, in order.

Runs in this browser, in an isolated frame with no access to this page. console.log, info, warn and error are shown; code runs as a classic script, so use an async function for await.

A real implementation also stores keys durably, expires them, and rejects a reused key that arrives with a different body.

The same checks with Playwright

Playwright's request fixture sends HTTP calls without opening a browser, using baseURL from the config:

1import { expect, test } from "@playwright/test"2 3test("a retried create with the same key makes one order", async ({ request }) => {4  const headers = { Authorization: `Bearer ${process.env.ALICE_TOKEN}`, "Idempotency-Key": crypto.randomUUID() }5  const data = { sku: "MUG", qty: 2 }6 7  const first = await request.post("/api/orders", { headers, data })8  const retry = await request.post("/api/orders", { headers, data })9 10  expect(first.status()).toBe(201)11  expect((await retry.json()).id).toBe((await first.json()).id)12})13 14test("Alice cannot read Bob's order", async ({ request }) => {15  const res = await request.get(`/api/orders/${process.env.BOB_ORDER_ID}`, {16    headers: { Authorization: `Bearer ${process.env.ALICE_TOKEN}` },17  })18  expect([403, 404]).toContain(res.status())19})

Create the users and orders these tests need through the API or a factory at the start of the run, not by hand in a shared environment.

Check yourself

3 questions. Get them all right to finish this topic.

1.Alice's valid token can GET /orders/123, which belongs to Bob, and gets 200. What kind of bug is that?
2.DELETE /items/7 returns 204 the first time and 404 the second. Is DELETE still idempotent?
3.A test only asserts expect(res.status()).toBe(200). What can still be broken?

0 of 3 right so far. Get all three to finish this topic.

API testing: status codes, schemas, idempotency, auth

How it works

What to check on every endpoint

Idempotency and retries

The same checks with Playwright

Check yourself

Go deeper