Erik Yverling, an API expert and soapUI developer at SmartBear-Sweden, gave this presentation at WebTech Conference 2012.

2. Erik R. Yverling | SmartBear
Testing APIs in the Cloud

3. Erik R. Überling | SmartBear
Testing APIs in the Cloud

4. A little bit about me
• Developer at SmartBear working on soapUI
• Lives in Stockholm, Sweden
• Agile enthusiast
• Linux and Open Source lover
• Just another fellow geek

5. No code :(

6. Recommendations!

7. Overview
• Golden age of APIs
• Testing APIs
• Testing APIs in the Cloud
• Testing APIs from the Cloud
• Recommendations

8. Golden age of APIs

9. Golden age of APIs
• APIs are at the core of business strategies – not just
technology strategies

10. Registred APIs
APIs are growing rapidly
Year
Source: programmableweb.com

11. Testing APIs
API

12. Quality aspects of APIs
• Functionality – does it work as expected?
• Performance – does it perform as required?
• Security – is it secured for common attacks?
• Usability – is it usable?
• Compliance – does it follow common practices?

13. How are APIs tested?
APIs generally implement a request-response
model for exchanging messages or data
Parameterized Request
Test API
Response
A simple test sends a request message and validates
that the response message has the expected content

14. Testing APIs in the Cloud
API

15. APIs + the Cloud = true
• High availability
• High scalability
• Easy deployment on the locations of your customer

16. Quality aspects of cloud APIs
• Functionality – does it work as expected?
• Performance – does it perform as required?
• Security – is it secured for common attacks?
• Usability – is it usable?
• Compliance – does it follow common practices?
• Policy and regulations– does it follow your legal regulations?

17. Functionality
• Does it matter where your API is deployed?
– Timestamps?
– Time zones?
– Locales?

18. Performance
• How to handle shared resources with others?
• How to make sure that the API is able to scale?

19. Security
• How to handle sensitive transactions to your
backend?

20. Policy and regulations
• How much of your traffic that is allowed to cross
country boarders?
• US export controls
• Is there a limit for load testing?
• What about costs related to transactions?

21. Policy and regulations
• What happens if your API stops working?

22. Testing APIs from the Cloud
API

23. Test Environment
as a service (TEaaS)
API

24. Quality aspects of APIs tested from the Cloud
• Functionality – does it work as expected?
• Performance – does it perform as required?
• Security – is it secured for common attacks?
• Usability – is it usable?
• Compliance – does it follow common practices?
• Policy and regulations– does it follow your legal regulations?

25. Functionality
• How will your application react to request from
different locations?

26. Performance
• How will your API react on distributed load?

27. Security
• Will you be able to test your API from all kinds of
locations?
• Is there some locations that should not be able to
reach the API?

28. Whoa!
Using the Cloud seams like a lot of work!

29. Recommendations!

30. Testing APIs in the Cloud
API

31. Functionality
• Reuse test cases during development for monitoring

32. In Agile you have
“Continuous Integration”
API Test should be run automatically and
continuously for every build of the software

33. In DevOps you have
“Continuous Deployment”
API Monitors run continuously to
ensure operations and production quality

34. Agile
Business Development Operations
DevOps

35. Benefits of Test Asset Reuse
Development :
Continuous Integration / Deployment
API Tests and
Quality Assets
Operations : API Monitoring

36. Functionality
• Reuse test cases during development for monitoring
• Start with a local baseline setup to compare with
• Mock out external dependencies to begin with
• Mind the backwards compatibility

37. Functionality
• Run regression tests against different locations
• Designing your application for failure recovery

38. Performance
• Make performance requirements
• Experiment with the load
• Parallelize
• Consider using dedicated machines
• Use monitoring together with the load test

39. Performance
• Run load tests in an isolated environment for root
cause analysis
• Chaos monkey!

40. Security
• Make security requirements
• Encrypt sensitive transactions to your backend
• Encrypt data before sending it to the Cloud
• Find out who is responsible for the different aspects
of security

41. Policy and regulations
• Check the legal implications with your company
experts
• Check what backup/recovery solution your provider
offers
• Check the providers regulations for load testing
• Do a calculation on what it may cost you to run your
load tests

42. Compliance
• Don’t always follow standards to the letter (others
may not).
• Look for best practices and reference
implementations

43. Testing APIs from the Cloud
API

44. Functionality
• Beware of from where you tests are run
• Run functional tests that depends on a geographical
location from that actual geographical location
• Easily create nodes in your test lab for different client
setups

45. Performance
• Use distributed load testing for better performance
• Scale your test suite along with your API

46. Security
• Make sure to cover locations that should not be able
to access the API
• Be aware of firewalls if your API is protected

47. Summary
• Golden age of APIs
• Testing APIs
• Testing APIs in the Cloud
• Testing APIs from the Cloud
• Recommendations

48. Try this at home!
• Check out soapUI Test On Demand
• http://www.soapui.org

49. ?

50. Contact
• @erikryverling
• @soapui
• erik.yverling@smartbear.com