Why UI testing is not enough
A user interface can hide a button, but the API still needs to reject unauthorized actions. For workflow systems, CMS tools, POS systems, and dashboards, QA should check the API behavior behind critical user actions.
I use API validation to confirm response status, permissions, required fields, error messages, and saved data.
Useful API checks
- Authorized user can complete the intended action.
- Unauthorized user receives a safe rejection.
- Missing or invalid fields return clear validation errors.
- Repeated requests do not create duplicate records.
- Response data matches the latest persisted state.
Database validation mindset
When access is allowed, database checks can confirm whether the saved record matches the UI and API. This is useful for report cards, POS totals, booking records, CMS content, and workflow audit trails.
The database should not be used to excuse a broken UI. It is one more observation that helps locate the failure.
Good evidence
A useful API defect report includes endpoint or operation name, request body, response status, response body, user role, record ID, and expected rule. Tokens and private data should be redacted before sharing.