Load testing API endpoints

Here’s a practical way to load test API endpoints.

1) Define what you want to measure

Typical goals:

• Throughput: requests/sec
• Latency: p50 / p95 / p99 response times
• Error rate: 4xx/5xx, timeouts
• Breaking point: max sustainable traffic
• Scalability: how performance changes as concurrency rises

2) Pick a load testing tool

Common options:

• k6: modern, scriptable, great for CI/CD
• JMeter: popular, GUI-based, broad support
• Locust: Python-based, flexible
• Gatling: strong for high-scale tests
• wrk / hey / ab: simple HTTP benchmarking tools

3) Create a test scenario

A good scenario should mimic real usage:

• Mix of endpoints
• Realistic request payloads
• Authentication if needed
• Think time / pauses between requests
• Different user journeys

Example patterns:

• Smoke test: low traffic, validate correctness
• Load test: expected peak traffic
• Stress test: push beyond limits
• Spike test: sudden traffic jump
• Soak test: sustained traffic for hours

4) Example using k6

Install

brew install k6
# or use your package manager / docker

Sample script

import http from 'k6/http';
import { check, sleep } from 'k6';

export const options = {
  stages: [
    { duration: '1m', target: 50 },
    { duration: '3m', target: 100 },
    { duration: '1m', target: 0 },
  ],
};

export default function () {
  const url = 'https://api.example.com/v1/items';
  const payload = JSON.stringify({
    name: 'test-item',
    value: 123,
  });

  const params = {
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${__ENV.TOKEN}`,
    },
  };

  const res = http.post(url, payload, params);

  check(res, {
    'status is 200 or 201': (r) => r.status === 200 || r.status === 201,
    'response under 500ms': (r) => r.timings.duration < 500,
  });

  sleep(1);
}

Run

TOKEN=your_token_here k6 run script.js

5) Example using curl + shell loop for a quick test

Not ideal for serious load testing, but useful for a quick check:

for i in {1..100}; do
  curl -s -o /dev/null -w "%{http_code} %{time_total}\n" \
    https://api.example.com/health
done

6) What to monitor during the test

Monitor both the client and server side:

• CPU, memory, disk I/O
• Network throughput
• DB query time, connections, locks
• Cache hit rate
• App logs and error traces
• Queue depth / worker saturation

7) Best practices

• Test in a staging environment that mirrors production
• Use dedicated test data
• Avoid unintentionally DOS’ing production
• Warm up caches before measuring steady state
• Increase traffic gradually
• Run tests multiple times for consistency
• Compare results against SLAs/SLOs

8) Common mistakes

• Testing with unrealistic payloads or no auth
• Running from a single slow machine that becomes the bottleneck
• Ignoring downstream dependencies
• Measuring only average latency instead of p95/p99
• Not resetting test data between runs

If you want, I can provide:

1. a k6 script for your specific API,
2. a JMeter test plan,
3. or a Locust example.