devLap

NEXT LEVEL LAB — DevOps API Testing (AWS + Auth + CI/CD mindset)

dev.to

🎯 Scenario

You deployed a backend API (FastAPI / Node / Java — doesn’t matter) on:

  • AWS ECS / EKS / EC2
  • Behind Load Balancer

Example API:

http://your-api-alb.amazonaws.com
Enter fullscreen mode Exit fullscreen mode

You must:

  • Verify it works
  • Validate authentication
  • Test protected endpoints
  • Catch failures BEFORE deployment

🧠 PART 1 — WHERE API IS LOCATED (REAL WORLD)

In real DevOps:

🔹 AWS ECS / ALB 

http://my-api-123.us-east-1.elb.amazonaws.com
Enter fullscreen mode Exit fullscreen mode

🔹 Kubernetes (Ingress) 

http://api.mycompany.com
Enter fullscreen mode Exit fullscreen mode

🔹 API Gateway 

https://abc123.execute-api.us-east-1.amazonaws.com/prod
Enter fullscreen mode Exit fullscreen mode

👉 This URL = your entry point

🧠 PART 2 — API STRUCTURE (REAL APP)

Typical endpoints:

Endpoint Purpose
/health Health check
/login Auth
/users Data
/orders Business logic

🚀 PART 3 — BUILD REAL POSTMAN COLLECTION

📁 ENVIRONMENT 

{"base_url":"http://your-api-alb.amazonaws.com"}
Enter fullscreen mode Exit fullscreen mode

✅ TEST 1 — HEALTH CHECK (CRITICAL)

Request: 

GET {{base_url}}/health
Enter fullscreen mode Exit fullscreen mode

Tests: 

pm.test("Service is UP", function () {
    pm.response.to.have.status(200);
});

pm.test("Response contains status OK", function () {
    const json = pm.response.json();
    pm.expect(json.status).to.eql("ok");
});
Enter fullscreen mode Exit fullscreen mode

👉 DevOps meaning:

  • Used in Load Balancer health checks
  • Used in Kubernetes readiness/liveness probes

✅ TEST 2 — LOGIN (AUTHENTICATION)

Request: 

POST {{base_url}}/login
Enter fullscreen mode Exit fullscreen mode

Body: 

{"username":"admin","password":"password123"}
Enter fullscreen mode Exit fullscreen mode

Tests: 

const json = pm.response.json();

pm.test("Login success", function () {
    pm.response.to.have.status(200);
});

pm.test("Token received", function () {
    pm.expect(json.token).to.exist;
});

// Save token globally
pm.environment.set("auth_token", json.token);
Enter fullscreen mode Exit fullscreen mode

👉 DevOps meaning:

  • Verifies authentication service
  • Detects broken IAM / auth integration

✅ TEST 3 — PROTECTED API (VERY IMPORTANT)

Request: 

GET {{base_url}}/users
Enter fullscreen mode Exit fullscreen mode

Headers: 

Authorization: Bearer {{auth_token}}
Enter fullscreen mode Exit fullscreen mode

Tests: 

pm.test("Authorized access", function () {
    pm.response.to.have.status(200);
});

pm.test("Users returned", function () {
    const json = pm.response.json();
    pm.expect(json.length).to.be.above(0);
});
Enter fullscreen mode Exit fullscreen mode

👉 DevOps checks:

  • Token works
  • Backend connected to DB
  • No 500 errors

❌ TEST 4 — SECURITY TEST (NO TOKEN)

Request: 

GET {{base_url}}/users
Enter fullscreen mode Exit fullscreen mode

(no headers)

Tests: 

pm.test("Unauthorized access blocked", function () {
    pm.response.to.have.status(401);
});
Enter fullscreen mode Exit fullscreen mode

👉 DevOps meaning:

  • Security validation
  • Prevents open APIs

⚡ TEST 5 — PERFORMANCE CHECK 

pm.test("Response time < 300ms", function () {
    pm.expect(pm.response.responseTime).to.be.below(300);
});
Enter fullscreen mode Exit fullscreen mode

👉 DevOps meaning:

  • Detect slow deployments
  • Catch DB/network issues

💣 TEST 6 — FAILURE SIMULATION

Request: 

GET {{base_url}}/crash
Enter fullscreen mode Exit fullscreen mode

Tests: 

pm.test("Server should not crash", function () {
    pm.expect(pm.response.code).to.not.eql(500);
});
Enter fullscreen mode Exit fullscreen mode

👉 DevOps:

  • Catch backend crashes early

🚀 PART 4 — AUTOMATION (REAL PIPELINE)

Export:

  • collection.json
  • environment.json

Run with Newman: 

newman run collection.json -e environment.json
Enter fullscreen mode Exit fullscreen mode

🔥 CI/CD PIPELINE EXAMPLE (REAL) 

name: API Tests

on: [push]

jobs:
  test-api:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install Newman
        run: npm install -g newman

      - name: Run API Tests
        run: newman run collection.json -e environment.json
Enter fullscreen mode Exit fullscreen mode

💣 REAL FAILURE SCENARIO

If:

  • /health fails → service DOWN
  • /login fails → auth broken
  • /users fails → DB broken

👉 Pipeline = ❌ FAIL
👉 Deployment = ❌ STOP

🧠 PART 5 — HOW DEVOPS DEBUGS

If test fails:

Step 1: 

curl http://api-url/health
Enter fullscreen mode Exit fullscreen mode

Step 2:

Check logs:

  • ECS → CloudWatch
  • Kubernetes → kubectl logs
  • EC2 → /var/log

Step 3:

Check:

  • Security groups
  • DB connection
  • Env variables

🧠 PART 6 — REAL INTERVIEW ANSWER

👉 Question:
"How do you validate API in DevOps?"

Answer:

I validate API using Postman collections with automated tests for health checks, authentication, authorization, and response validation. Then I run them using Newman in CI/CD pipelines to ensure deployments do not break backend services.

You now understand:

✔ Where API lives (ALB, EKS, API Gateway)
✔ How to find endpoints
✔ What DevOps tests (NOT QA level)
✔ Auth + security testing
✔ Performance checks
✔ CI/CD automation
✔ Failure handling

Read Full Article open_in_new
arrow_back Back to News