How to Test an API: A Step-by-Step Guide

Testing an API does not have to mean a tangle of curl commands and copy-pasted tokens. With a modern API client you can send a request, inspect the response, parameterize it, assert that it is correct, chain calls together, and run the whole thing against a data file - all in one place. This step-by-step guide walks the full loop using Requestly as the worked example, so every step is concrete and every snippet is real.

Step 1: Send Your First Request

A request is four things: a method, a URL, headers, and (for writes) a body. In Requestly you pick the method, type the URL, add headers, and choose a body type - raw JSON, form-urlencoded, multipart with file upload, or GraphQL. A simple login request looks like this:

POST /api/v1/login HTTP/1.1
Host: api.example.com
Content-Type: application/json

{
  "email": "dev@example.com",
  "password": "s3cr3t"
}

Hit Send and you have made your first call. If you are coming from curl, an OpenAPI spec, a Postman collection, or a HAR file, you can import those directly instead of rebuilding requests by hand.

Step 2: Read and Inspect the Response

A response tells you four useful things: the status code (200, 201, 401, 429…), the body, the headers, and the timing. Requestly shows all four for every call. A successful login might return:

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": { "id": 1024, "email": "dev@example.com" }
}

Reading the response by eye is fine for one call. The moment you care about repeatability, you want to assert it automatically - which is Step 4. If you ever get an unexpected 401 here, our guide on fixing 401 Unauthorized errors walks through the usual culprits.

Step 3: Parameterize With Environment Variables

Hardcoding hostnames and tokens into every request does not scale. Environment variables let you define values once - a baseUrl, an authToken - and reference them anywhere with the {{variable}} syntax. Switch environments (local, staging, production) and the same requests retarget instantly.

GET {{baseUrl}}/api/v1/orders HTTP/1.1
Authorization: Bearer {{authToken}}
Accept: application/json

Requestly supports multiple variable scopes with clear precedence, so a local override can shadow a shared value when you need it. For the full breakdown, see using environment variables in API testing.

Set up your first environment: Define a baseUrl and token once, then reuse them across every request in the Requestly API client. Try it free →

Step 4: Add Assertions and Tests

This is where testing gets real. A post-response script runs after each request and lets you assert exactly what “correct” means using rq.test and the Chai-style rq.expect. You read the status with rq.response.code and the parsed body with rq.response.json():

const data = rq.response.json();

rq.test("Login succeeds", function () {
    rq.expect(rq.response.code).to.equal(200);
});

rq.test("Response shape is correct", function () {
    rq.expect(data).to.have.property("token");
    rq.expect(data.user).to.have.property("id");
    rq.expect(data.user.email).to.be.a("string");
});

Those three checks turn a manual eyeball into a repeatable contract. Requestly can even generate a starting set of tests for you with its AI test generator, which you then refine. For a deeper tour of assertion patterns, see our guide to API assertions and tests, and for a grab bag of ready-to-use snippets, 10 practical script examples for API testing.

Step 5: Chain Requests Together

Real workflows are multi-step: log in, grab the token, then call a protected endpoint. You chain requests by extracting a value in a post-response script and saving it to an environment variable with rq.environment.set:

// Post-response script on the login request
const body = rq.response.json();
rq.environment.set("authToken", body.token);

rq.test("Token captured", function () {
    rq.expect(rq.environment.get("authToken")).to.be.ok;
});

The very next request just references {{authToken}} in its Authorization header - no copy-pasting tokens between tabs. This extract-and-reuse pattern is the backbone of API workflows; see how to chain API requests for the full walkthrough, and pre-request and post-response scripts for everything the rq.* API can do.

Step 6: Run a Whole Collection With a Data File

Once you have a handful of related requests, group them and run them in sequence with the Collection Runner. Better still, data-drive the run with a CSV or JSON file so the same requests execute once per row - perfect for testing many inputs without duplicating requests. A CSV might look like:

email,password,expectedStatus
dev@example.com,s3cr3t,200
bad@example.com,wrongpass,401
,nopassword,400

Each row becomes a set of variables your requests reference with {{email}} and {{password}}, and your post-response tests read each row’s value with rq.iterationData.get('expectedStatus') and assert against it. One run, full coverage of your happy path and your edge cases.

Step 7: Organize Into Collections and Reuse

As your suite grows, structure it into collections - grouped requests for a feature or service - and lean on environments so the same collection runs against local, staging, and production. Share collections through a team workspace so everyone tests against the same source of truth, keep secrets in the Vault rather than in plain variables, and you have a maintainable testing setup rather than a pile of one-off requests.

Putting It All Together

The full loop is: send a request, inspect the response, parameterize with environment variables, assert with rq.test, chain by extracting values, run a data-driven collection, and organize for reuse. Each step builds on the last, and none of it requires leaving your API client. If you are still choosing tooling, our roundup of the best API testing tools puts the options in context, and if you are deciding between API styles, WebSocket vs REST covers when each one fits.

Run the whole loop yourself: Send, inspect, assert, chain, and run a data-driven collection - all in one local-first client. Try the Requestly API Client →

Frequently Asked Questions

How do I test an API step by step?

Send a request with a method, URL, headers, and body; inspect the response status, body, headers, and timing; parameterize values with environment variables and {{var}} syntax; add assertions with rq.test and rq.expect; chain requests by extracting values into variables; then run a data-driven collection and organize requests for reuse.

How do I write an assertion in Requestly?

In a post-response script you wrap checks in rq.test(‘name’, function(){ … }) and assert with the Chai-style rq.expect. Read the status code with rq.response.code and the parsed JSON body with rq.response.json(), for example rq.expect(rq.response.code).to.equal(200).

How do I chain API requests?

In the first request’s post-response script, extract the value you need from rq.response.json() and store it with rq.environment.set(‘authToken’, body.token). The next request references it with {{authToken}}, so you never copy values between requests by hand.

What are environment variables used for in API testing?

Environment variables let you define values like a base URL or auth token once and reference them anywhere with {{variable}} syntax. Switching environments such as local, staging, and production retargets every request instantly, and Requestly supports multiple variable scopes with clear precedence.

Can I run the same API tests against many inputs?

Yes. Use the Collection Runner with a CSV or JSON data file. Each row becomes a set of variables your requests reference with {{var}}, so the same requests execute once per row - letting you cover happy-path and edge cases in a single run without duplicating requests.

Does Requestly support importing existing requests?

Yes. You can import from cURL, OpenAPI, Postman, HAR, and WSDL, so you do not have to rebuild requests by hand when moving from another tool or an existing API specification.