HTTP status codes, headers, and response payloads are the primary signals APIs use to communicate success, failure, and additional context. If you only check that the status code is 200, you may miss incorrect error handling, missing headers, or malformed JSON. Thorough validation looks at all three layers.
Validating Status Codes and Error Responses
Status codes indicate the high-level outcome of a request: 2xx for success, 4xx for client errors, and 5xx for server errors. Within these ranges, specific codes such as 200, 201, 400, 401, 404, and 500 carry distinct meanings. Testers should verify that the API returns appropriate codes for each scenario and that error responses include useful messages or error structures.
# Example: check status and body with curl and jq
curl -s -w "Status: %{http_code}
" -X POST "https://api.example.com/v1/customers" -H "Content-Type: application/json" -d '{"name": "", "email": "bad"}' | tee /tmp/resp.json
jq '.error.code, .error.message' /tmp/resp.jsonHeaders convey important metadata such as content type, caching directives, correlation IDs, and rate limiting information. Testing should confirm that required headers are present and correctly formatted, especially for security and observability.
Payload and Schema Validation
Beyond basic field checks, schema validation verifies that responses follow the structure defined in API documentation or contracts. Tools can validate JSON against a schema, ensuring that required fields exist, types are correct, and unknown fields are flagged. This helps catch breaking changes early when services evolve.
Common Mistakes
Mistake 1 — Checking only the HTTP status code
This misses incorrect error payloads or missing fields.
❌ Wrong: Asserting only that the status is 200 for success cases.
✅ Correct: Validate status, headers, and key response fields together.
Mistake 2 — Ignoring response headers in tests
Headers often carry security and caching information.
❌ Wrong: Never checking headers like Content-Type or Authorization-related values.
✅ Correct: Include header checks where they are significant to behaviour or compliance.