Most API test suites are decorative.
They're green, they run on every build, and they check almost nothing that matters: a wall of status is 200 assertions over happy-path requests. When the API starts returning the wrong data, the wrong errors, or leaking internals in a stack trace, the suite stays green — because nobody ever decided what it was supposed to catch.
Tools execute tests; testers choose them. Given an endpoint, what should you actually verify? Here's the framework I use — five layers, three axes of case design, and a way to prioritise when you can't test everything first. Examples use Postman's test scripts, but the framework is tool-agnostic.
The layered checklist
For every endpoint that matters, work outside-in through five layers.
