How do I test API status codes, headers, and JSON payloads?

You can test API status codes, headers, and JSON payloads with tools like curl, Postman, pytest + requests, or your language’s HTTP client. The basic idea is:

1. Send a request
2. Check the response status code
3. Verify response headers
4. Validate the JSON body

1) With curl and manual inspection

Useful for quick checks.

curl -i https://api.example.com/users/1

• -i includes response headers
• You can inspect:
  • Status line: HTTP/1.1 200 OK
  • Headers like Content-Type: application/json
  • Body JSON

If you want just headers:

curl -I https://api.example.com/users/1

2) With Postman

In Postman tests tab:

pm.test("Status code is 200", function () {
  pm.response.to.have.status(200);
});

pm.test("Content-Type is JSON", function () {
  pm.response.to.have.header("Content-Type");
  pm.expect(pm.response.headers.get("Content-Type")).to.include("application/json");
});

pm.test("Response has user id", function () {
  const json = pm.response.json();
  pm.expect(json).to.have.property("id");
});

3) With Python pytest + requests

Example:

import requests

def test_get_user():
    response = requests.get("https://api.example.com/users/1")

    # Status code
    assert response.status_code == 200

    # Headers
    assert response.headers["Content-Type"].startswith("application/json")

    # JSON body
    data = response.json()
    assert "id" in data
    assert data["id"] == 1

More JSON checks

def test_user_fields():
    response = requests.get("https://api.example.com/users/1")
    data = response.json()

    assert data["name"] == "Alice"
    assert isinstance(data["email"], str)
    assert "created_at" in data

4) With JavaScript / Node.js (jest + axios or fetch)

import axios from "axios";

test("GET /users/1 returns valid response", async () => {
  const response = await axios.get("https://api.example.com/users/1");

  expect(response.status).toBe(200);
  expect(response.headers["content-type"]).toContain("application/json");
  expect(response.data).toHaveProperty("id");
});

5) What to validate

Status codes

• 200 OK
• 201 Created
• 400 Bad Request
• 401 Unauthorized
• 403 Forbidden
• 404 Not Found
• 500 Internal Server Error

Headers

• Content-Type
• Authorization-related behavior
• Cache-Control
• Location (common with 201 responses)
• ETag, Set-Cookie, etc.

JSON payload

• Required fields exist
• Values are correct
• Data types match
• Nested fields exist
• Arrays contain expected items
• Error responses have expected structure

Example error check:

def test_bad_request():
    response = requests.get("https://api.example.com/users/abc")
    assert response.status_code == 400
    data = response.json()
    assert "error" in data

6) Best practice: test exact response schema

If your API uses JSON Schema, you can validate the whole response structure instead of only a few fields.

Python example with jsonschema:

from jsonschema import validate

schema = {
    "type": "object",
    "properties": {
        "id": {"type": "integer"},
        "name": {"type": "string"}
    },
    "required": ["id", "name"]
}

def test_user_schema():
    response = requests.get("https://api.example.com/users/1")
    validate(instance=response.json(), schema=schema)

If you want, I can also show you:

• how to do this in Postman
• how to write pytest API tests
• how to test with JavaScript/Jest
• how to validate JSON schema more thoroughly