Stop 05 · SQL & Databases for QATopics · 5/8

Backend Testing

In short

The UI is just the front window. Behind it, APIs and the database do the real work. Testing them directly is faster, steadier and catches bugs the screens hide.

Testing the server-side logic, database, and APIs directly, without going through the UI — catches issues that UI testing alone would miss, and is often faster and more stable to automate.

The purple blob with a clipboard opens a large steel fridge in a restaurant kitchen.

Think of it like this

Inspecting the restaurant kitchen

A food inspector doesn't judge a restaurant by its menu card. They walk into the kitchen and check the fridge temperature, the oil and the storage. Backend testing walks past the UI into the kitchen.

Watch it happen

Testing an API without the UI

Tester

API

Database

POST /orders qty: -1

1/5The tester sends a bad request directly. The UI would never allow -1, but an attacker could.

The big ideas

What you need to know

Never trust the UI alone

Anyone can call an API directly. Server-side validation must catch what the UI blocks.

Faster and steadier

API tests skip page loads and locators, so they run quicker and break less than UI tests.

Check every layer

Status code, response body, database rows and side effects like emails or queue messages.

See it in code

Walk through the code

bash

1# Call the API directly, no browser involved2curl -s -X POST https://staging.example.com/api/orders \3  -H "Content-Type: application/json" \4  -H "Authorization: Bearer $TOKEN" \5  -d '{"productId": 7, "qty": -1}' \6  -w "\nstatus: %{http_code}\n"7 8# Expected: status 400 with an error, and no new row in orders

1/3POST to the endpoint on the test server, never production.

A negative test with curl against a staging API. Then confirm in the database that nothing was saved.

Save yourself the pain

Common mistakes

Oops

Testing validation only through the UI.

Do this instead

Send invalid requests straight to the API. That's what attackers and buggy clients do.

Oops

Checking just the status code.

Do this instead

Also check the response body, database state and any side effects.

Your mission

Poke a public test API

~25 min

Quick check

The UI blocks negative quantities, but the API accepts qty: -1. Is this a bug?

Go deeper

1Design a backend test scenario verifying business logic directly at the database or API level.
2Learn why backend tests tend to be faster and less flaky than UI-driven tests.
3Understand backend testing complements, rather than replaces, UI-level testing.