← API Testing with Postman learning pathAPI Testing with Postman · Module 9 of 10
Beyond functional API testing
Check performance, security basics and contracts.
📖 Key ideas
- Performance: Postman performance runs, k6 or JMeter for load.
- Negative tests: invalid input, missing fields, wrong types.
- Security checks (authorised): auth required, permissions enforced, no sensitive data leaked.
- Validate rate limiting and error messages.
- Test GraphQL and WebSocket APIs too.
💡 Real-life example: Negative testing is checking the vending machine rejects fake coins as reliably as it accepts real ones.
Negative testTest with invalid input
Load testMany concurrent requests
Rate limitingRestricting requests per time
Authorisation checkVerifying permission enforcement