Negative Testing in APIs: Common Scenarios & Best Practices

Negative testing in APIs means verifying how the API behaves when it receives invalid, unexpected, or malicious input. The goal is to ensure the API fails gracefully, returns proper error codes, and doesn’t crash or expose sensitive data.

What to Test in Negative Testing

1. Invalid Input Data

Send wrong data types or formats
Example:

{ "age": "twenty" }

Expect: 400 Bad Request

2. Missing Required Fields

Missing required field like email

{ "name": "John" }

Expect: Validation error (400)

3. Invalid authentication

• No token
• Expired token
• Wrong token

Expect : 401 unauthorized

4. Unauthorized Access

• Access admin API with normal user

Expect: 403 forbidden

Get Juhi Mondal’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

5. Invalid URL or Endpoint

GET /api/unknown

Expect : 404 Not found

6. Method not allowed

POST /api/users (when only GET is allowed)

Expect : 405 Method Not Allowed

7.Boundary Value Testing

• Very large input
• Empty strings
• Special characters

{ "name": "aaaaaaaaaaaaaaaaaaaa...." }

Expect: Proper validation errors like Status: 400 or 413 Payload Too Large

8. Special Characters / Injection

{ "username": "' OR 1=1 --" }

Expect : Status: 400

• No SQL/system exposure

9. Duplicate Data Submission

Create same user twice
Expect : Status: 409 Conflict or validation error

Example in Postman

pm.test("Status code should be 400", function () {
  pm.response.to.have.status(400);
});

pm.test("Error message validation", function () {
  const jsonData = pm.response.json();
  pm.expect(jsonData.error).to.include("Invalid input");
});

Best Practices

• Always validate status code + error message
• Check API does NOT expose stack traces or internal data
• Test edge cases (null, empty, large payloads)
• Include security cases (SQL injection, script input)