API Practice
API Testing Practice
Practice API contracts, auth, validation, permissions, status codes, and backend error handling in safe browser sandboxes.
Recommended start
Start with 3 practical API trainers
These are the clearest first scenarios for learning API test design. Every sandbox is client-side only; no real backend is called.
Login API
Practice auth contracts, credential failures, account states, tokens, and safe error handling.
Start practiceCreate User API
Practice request validation, response schema, auth, permissions, persistence, and security.
Start practicePassword Reset API
Practice reset links, token expiry, reuse, rate limits, email failures, and session invalidation.
Start practiceScenario browser
Choose a practice scenario
Browse free trainers, implemented Early Pro trainers, and roadmap scenarios from one place.
Free includes 10 trainers you can use now. Early Pro unlocks additional implemented trainers and future practice paths.
Showing 12 of 55 total scenarios.
Login API Practice
Practice Login API contract checks, credential failures, account states, MFA, tokens, rate limiting, security, and observability.
Security/Auth, Tokens, Enumeration, Sessions
Start practiceCreate User API Practice
Practice request validation, response schema, auth, permissions, persistence, and security for a realistic Create User endpoint.
Contract, Validation, Persistence, Security
Start practiceToken Refresh API Practice
Practice access token expiry, refresh token rotation, revoked sessions, token reuse, and secure auth error handling.
Security/Auth, Rotation, Revocation, Sessions
Start practiceRoles & Permissions API Practice
Practice role-based access control, forbidden actions, admin-only endpoints, tenant isolation, and privilege escalation risks.
Security/Auth, RBAC, Tenant isolation, Audit
Start practicePagination API Practice
Practice Pagination API contract checks, cursor behavior, validation, stable ordering, data consistency, permissions, performance, and observability.
Pagination, Cursors, Performance, Data consistency
Start practiceMFA Challenge API Practice
Practice MFA challenge verification, invalid and expired codes, backup codes, trusted devices, delivery failures, lockout, and abuse protection.
Security/Auth, MFA, Recovery, Abuse prevention
Start practicePassword Reset API Practice
Practice Password Reset API contract checks, reset requests, token validation, password policy, session invalidation, security, email side effects, and observability.
Security/Auth, Email, Token handling, Abuse prevention
Start practiceSession Logout API Practice
Practice logout, session invalidation, token revocation, cookie clearing, multi-device behavior, and safe auth failure handling.
Security/Auth, Logout, Sessions, Revocation
Start practiceFile Upload API Practice
Practice File Upload API test design for multipart contracts, validation, malware scanning, storage side effects, auth, security, and reliability.
Files, Validation, Security, Storage
Start practiceSearch API Practice
Practice Search API test design for query validation, relevance, pagination, permissions, security, timeouts, and observability.
Search, Relevance, Permissions, Performance
Start practiceAccount Lockout API Practice
Practice failed-attempt thresholds, cooldown, CAPTCHA or step-up behavior, safe errors, unlock recovery, and observability.
Implemented trainer - Available in Early Pro
Security/Auth, Lockout, Abuse prevention, Observability
Unlock trainerAPI Key Management API Practice
Practice API key creation, scopes, one-time secret display, rotation, revocation, tenant permissions, leakage, and auditability.
Implemented trainer - Available in Early Pro
Security/Auth, API keys, Scopes, Audit
Unlock trainerNeed personal help instead?
Early Pro is self-serve practice. Coaching is for direct feedback on your API testing answers.