To Open Banking and Beyond: Developing APIs that are Resilient to every new Initiative

© Curiosity Software Ireland Ltd. 2020
To Open Banking and Beyond:
Developing APIs that are Resilient to Every New
Initiative
January 30th 2020
Patrick Poulin
CEO, API Fortress
patrick@apifortress.com
@PatrickPoulin
James Walker, PhD
Director, Curiosity Software Ireland
James.Walker@Curiosity.Software
@CuriositySoft

To Open Banking and Beyond
1. Understanding API testing complexity
2. A new approach to testing massively complex APIs
3. API Testing: What’s at stake?
4. Q&A and discussion

1. Understanding API testing complexity

QA must meet the speed of innovation
• Modern delivery practices mean new components are added faster than ever before.
• Each one brings its own world of logic.
• The # of decision then gates grows exponentially - as do the possible data inputs.
• This maze of logic needs to be tested with a rigorous set of distinct data combinations.
• The stakes are high – with initiatives like Open Banking, APIs often carry sensitive
personal and financial data.
• Flawed APIs can then spell customer churn, legislative penalties, and brand damage.

• Modern delivery = new components added faster
than ever before = new worlds of logic.
• The # of decision gates and data combinations
grows exponentially.
API call soup
Expected
Result?
API Testing: How many paths?

How many paths are you hitting?
Meeting the speed of API-driven development requires a new approach to testing.
1. Creating API tests one-by-one in test tools or through scripts is too slow and ad hoc.
2. Tests hit just a fraction of the logical combinations contained across combined APIs.
3. Expected results are also hard to define from service definitions and requirements. Second
guessing expected responses undermines the reliability of API testing.
4. Test data lacks the combinations needed for rigorous API testing. Low-variety copies of
production data focus on past data and are almost exclusively “happy path”.
5. There is often not access to in-house and third-party systems for test execution.

2. A new approach to testing massively complex APIs

Model-Based Test Automation
Recorded
tests activity
Test Cases & BDD Scenarios
BPMN
diagrams
Service Definitions
Message Traffic
Business
Requirements
Application Scans
Reactive Model
of the system
Find / Make / Allocate Test Data
Run Results
Tests
New
Iteration
 Perfect sets of tests
 Fast Maintenance
 Reusable Components
 Move faster
 Deliver with confidence
Test AutomationTest Automation

Reactive and rigorous API Testing
Find test data from across back-end databases
Test Data
System Under
Test
REST
SOAP
GraphQL
Web Services
Microservices
Parameterised tests
Run results
Service Definitions
Message Traffic
BDD/Gherkin

Demo

This approach to API testing:
• Provides a simple way to test complex APIs in
the cloud:
• There is a range of accelerators/time saving features
• You can start creating rigorous API tests in minutes
• Automation creates sets of coverage focused
scenarios to drive testing
• Moves faster :
• Quickly and systematically build automated API tests
• Have quality test data in the right place, at the right time
• Run automation suites on demand in the cloud
• Increases quality and confidence:
• Testing rigorously finds bugs earlier, and at less cost to fix
• Mathematics systematically creates tests (coverage)
• You can track exactly which features you are testing

3. API Testing: What’s at stake?

Data is Key
● Go beyond a stagnant set of test data
● Use dynamic data from sources like databases and APIs
● Differentiate the data sources and environments you test against
● Don’t forget that APIs at larger organizations involve many different
teams, with different understandings of the APIs’ goals
● Don’t fear testing against live data: it is often the only way to truly reveal
issues

Next Step: Integration Testing

Next Step: Integration Testing
● Whenever possible, reproduce entire user flows on the API level
● Reproduce normal user behaviors in a single test
● Test using good and bad data, to validate all types of responses

Functional Tests as Monitors
● Your existing functional tests should be scheduled as API monitors
● Run multi-step integration tests as monitors
● There is a big difference between Uptime and Functional Uptime
● Test third-party APIs as well as internal and partner APIs
● Monitor production as well as internal staging environments
● Monitors can help catch things like memory leaks

What is Performance Testing?
● Performance can mean different things to different people
● For APIs, it should mean load testing (stress testing), as well as monitoring
the latency and fetch from your APIs being monitored
● A payload should have a max size, and respond in a certain amount of
time, otherwise it could crash mobile apps
● Stress test using full functional and integration tests
○ This properly validates API health from a real world user’s
perspective

PSD2 / Open Banking - What Does It All
Mean?

PSD2 / Open Banking - What Does It All
Mean?
● Keep in mind that “open banking” is not unified. Hopefully, someday
the protocols will all be interchangeable, but Open Banking and PSD2
are not in line with the UAE’s vision for it (for example).
● Even banks doing PSD2 aren’t perfect and have their own slight
variations. This means that you need a solution to test with variability.
One test does not fit all, but it can help.
● More than ever, it is important that banks validate that these APIs do
not expose sensitive data in live environments

What next? Try this approach
yourself!
• We’ll email you the slides and webinar recording
• Book a demo with API Fortress and/or Curiosity (we’ll email you the
links)
• Visit Testmodeller.io and Apifortress.com for your free trial(s)
• Head to Testmodeller.io/Tutorials to find out how you can use Test
Modeller and API Fortress together

Questions and Discussion

Thank you for listening.
James.Walker@Curiosity.Software , Patrick@APIFortress.com
Email us if you have any questions or feedback, or would like a demo of
any of the technology shown

To Open Banking and Beyond: Developing APIs that are Resilient to every new Initiative

More Related Content

What's hot (20)

Similar to To Open Banking and Beyond: Developing APIs that are Resilient to every new Initiative (20)

More from Curiosity Software Ireland (17)

Recently uploaded (20)

To Open Banking and Beyond: Developing APIs that are Resilient to every new Initiative

Editor's Notes