24REST Assured (Java)

24.1 What REST Assured is

REST Assured is a Java DSL (domain-specific language) for testing HTTP APIs. It is the most popular API testing library in Java/JUnit/TestNG shops. It wraps Apache HTTP Client and adds a readable, fluent BDD-style assertion syntax.

Why teams use it:

• Reads almost like English — easy to onboard manual testers transitioning to automation
• Built-in JSONPath and XMLPath extraction
• Tight integration with TestNG/JUnit, Maven/Gradle, Allure reports
• Same Java codebase as the application — shared models, no extra runtime

24.2 Setup (Maven)

// pom.xml dependency
<dependency>
  <groupId>io.rest-assured</groupId>
  <artifactId>rest-assured</artifactId>
  <version>5.5.0</version>
  <scope>test</scope>
</dependency>
<dependency>
  <groupId>org.testng</groupId>
  <artifactId>testng</artifactId>
  <version>7.10.2</version>
  <scope>test</scope>
</dependency>

// Static imports — make tests readable
import static io.restassured.RestAssured.*;
import static io.restassured.matcher.RestAssuredMatchers.*;
import static org.hamcrest.Matchers.*;

24.3 The Given–When–Then syntax

REST Assured follows BDD style:

• given() — set up the request (headers, params, body, auth)
• when() — perform the HTTP verb
• then() — assert on the response

@Test
public void getUserReturns200() {
  given()
    .baseUri("https://api.example.com")
    .header("Accept", "application/json")
  .when()
    .get("/users/42")
  .then()
    .statusCode(200)
    .contentType("application/json")
    .body("id", equalTo(42))
    .body("email", equalTo("alice@test.com"))
    .body("roles", hasItem("admin"))
    .time(lessThan(500L));
}

24.4 POST with a JSON body

@Test
public void createUser() {
  String payload = "{\"name\":\"Alice\",\"email\":\"alice@test.com\"}";
  given()
    .baseUri("https://api.example.com")
    .contentType("application/json")
    .body(payload)
  .when()
    .post("/users")
  .then()
    .statusCode(201)
    .body("id", notNullValue())
    .header("Location", containsString("/users/"));
}

24.5 JSONPath — extracting and asserting

REST Assured uses Groovy GPath syntax (basically JSONPath with dots):

// Body: { "orders": [ { "id":1, "total": 99 }, { "id":2, "total": 49 } ] }

given().when().get("/orders").then()
  .body("orders.size()", equalTo(2))
  .body("orders[0].id", equalTo(1))
  .body("orders.total", hasItems(99, 49))
  .body("orders.findAll { it.total > 50 }.size()", equalTo(1))   // groovy filter
  .body("orders.total.sum()", equalTo(148));

// Extract a value
int orderId = given().when().get("/orders").then()
  .extract().path("orders[0].id");

// Extract whole response
Response res = given().when().get("/orders");
List<Integer> totals = res.jsonPath().getList("orders.total");

24.6 Auth patterns

// Basic
given().auth().basic("user", "pass").when().get("/secure").then().statusCode(200);

// Bearer
given().auth().oauth2(token).when().get("/me").then().statusCode(200);

// API key as header
given().header("x-api-key", "abc123").when().get("/v1/data").then().statusCode(200);

// OAuth2 password grant — fetch token, then use it
String token = given()
    .contentType("application/x-www-form-urlencoded")
    .formParam("grant_type", "password")
    .formParam("username", "qa")
    .formParam("password", "qa-pass")
  .when().post("/oauth/token")
  .then().extract().path("access_token");

24.7 Serialization with POJOs (Jackson)

Rather than building JSON strings by hand, define a Java class and let Jackson serialise it:

public class User {
  public String name;
  public String email;
  public User(String name, String email) { this.name = name; this.email = email; }
}

@Test
public void createUserWithPojo() {
  User payload = new User("Alice", "alice@test.com");
  User created = given()
      .contentType("application/json")
      .body(payload)
    .when().post("/users")
    .then().statusCode(201)
    .extract().as(User.class);     // deserialise response

  assertEquals(created.name, "Alice");
}

24.8 Reusable request specs

// Define once
public class Specs {
  public static RequestSpecification authed() {
    return new RequestSpecBuilder()
      .setBaseUri("https://api.example.com")
      .setContentType("application/json")
      .addHeader("Authorization", "Bearer " + System.getenv("TOKEN"))
      .build();
  }
}

// Use in every test
given().spec(Specs.authed()).when().get("/me").then().statusCode(200);

24.9 Logging

// Log everything (great for debugging a failing test)
given().log().all()
  .when().get("/users/42")
  .then().log().ifValidationFails()
  .statusCode(200);

// Common config: log on failure only
RestAssured.filters(
  new ErrorLoggingFilter(),
  new ResponseLoggingFilter(LogDetail.STATUS)
);

24.10 Negative cases

@Test public void missingEmailReturns400() {
  given().contentType("application/json").body("{\"name\":\"A\"}")
    .when().post("/users")
    .then().statusCode(400)
    .body("errors.email", equalTo("required"));
}

@Test public void wrongTokenReturns401() {
  given().auth().oauth2("invalid").when().get("/me").then().statusCode(401);
}

@Test public void userTriesAdminReturns403() {
  given().auth().oauth2(userToken).when().delete("/admin/items/1").then().statusCode(403);
}

24.11 REST Assured vs Playwright API — honest comparison

24.12 Side-by-side: same test in both

REST Assured

@Test public void getOrders() {
  given().auth().oauth2(token)
    .when().get("/api/orders")
    .then().statusCode(200)
      .body("size()", greaterThan(0))
      .body("[0].total", greaterThan(0f));
}

Playwright

test('GET /api/orders', async ({ request }) => {
  const res = await request.get('/api/orders', {
    headers: { Authorization: `Bearer ${token}` },
  });
  expect(res.status()).toBe(200);
  const body = await res.json();
  expect(body.length).toBeGreaterThan(0);
  expect(body[0].total).toBeGreaterThan(0);
});