An API test is more than a status code. Record the method, URL path, query parameters, headers, body, and environment used, then inspect response status, headers, body, and timing. Start with a documented success case, followed by missing fields, invalid types, and an authentication failure using disposable credentials.
Never paste live tokens or private payloads into a public report. If the response looks wrong, compare it with the API's own contract and repeat with a minimal request. Redact secrets while retaining the fields needed to reproduce the behavior. Distinguish a server error from a client-side display or JSON-parsing error.
Akousa