Testing an API

Test what the client actually calls

Unit tests on handlers miss routing, middleware, serialisation, and status codes — which is where API bugs live. Tests that make real requests through the whole stack catch them.

The error paths deserve as much coverage as the happy path: unauthenticated, unauthorised, malformed body, missing resource, conflict. These are the responses clients handle most often and that break most silently.

Tests that depend on execution order or on data another test created fail mysteriously and get deleted. Each test should set up what it needs.