API QA: market

Vacancy

an open job that cleared the quality gate and lists at least two technologies

Observed candidate

a candidate whose stack contains this technology; an aggregate — not a single record leaves the perimeter

Matchable candidate

not counted yet

Window

jobs open at the moment the snapshot was built

Top-5: playwright, python, java, postman, jira. Manual testing and API exploration: Postman (dominant — requests, collections, environments, built-in tests; Newman — running collections in CI), Bruno (open-source alternative, on git files — growing), Insomnia, SoapUI / ReadyAPI (including SOAP). Automation: REST Assured (Java — classic of API autotests), pytest + requests / httpx (Python — popular stack), Karate (BDD framework for API in Gherkin), Playwright API testing, supertest (Node.js). Contract testing: Pact (consumer-driven contracts). Specifications and validation: OpenAPI / Swagger, JSON Schema, Schemathesis (test generation from OpenAPI spec). Mocks: WireMock, Prism, Mountebank. Adjacent: SQL (check that data correctly landed in DB), CI/CD, Git, Docker. Knowledge: HTTP (methods, status codes, headers), REST / GraphQL / gRPC, authentication (OAuth 2.0, JWT, API keys), formats (JSON / XML), API design principles. For automation a programming language is mandatory — more often Java or Python.

Postman — standard for manual exploration and quick API check: convenient GUI, collections, environments, can write tests in JavaScript; through Newman collections run in CI. Downside as automation framework — tests in JSON collections scale and version worse than code. REST Assured — Java library, classic of API automation: expressive given-when-then DSL, easily integrates with JUnit / TestNG and Java ecosystem; choice if team and project on Java. pytest + requests / httpx — Python stack: flexible, laconic, low entry threshold, huge pytest ecosystem (fixtures, parametrization, plugins); choice of Python teams. Karate — self-contained BDD framework for API: tests written in Gherkin-like syntax, doesn't require Java knowledge for writing tests, built-in JSON checks, mocks, load testing; good when need to connect less technical people to API tests. Strategy: Postman — must know (it's everywhere, for manual work and quick check). For automation — by team stack: REST Assured (Java projects), pytest (Python projects), Karate (if low threshold and BDD matter). Tool is secondary — primary are understanding of HTTP, API architecture and skill of writing maintainable tests.

REST — the most widespread API style: resources by URL, HTTP methods (GET / POST / PUT / DELETE), status codes, usually JSON. Testing — checking endpoints, methods, response codes, request / response bodies, error handling, validation; tools — Postman, REST Assured, pytest. GraphQL — one endpoint, client describes in the query what fields they need. Testing features: checking schema and resolvers, that exactly needed fields are requested, handling partial errors (GraphQL can return 200 with errors array), depth and complexity of queries (protection from heavy queries), N+1 problems. Tools — Postman (supports GraphQL), Apollo tools, specialized clients. gRPC — binary protocol based on Protocol Buffers over HTTP/2, popular for communication between microservices. Features: contract is set by.proto files (strict typing), special clients needed (grpcurl, Postman supports gRPC, BloomRPC), unary and streaming calls are tested. SOAP — legacy (XML, WSDL), still encountered in enterprise and banks; tool — SoapUI / ReadyAPI. Common: regardless of protocol, API QA checks contract, business logic, error handling, security and integration. Transport, format and tools differ — but test design principles are the same.

Contract testing solves a typical pain of microservice architecture: service A ("consumer") calls service B's ("provider") API; team B changes its API — and imperceptibly breaks A; full-fledged end-to-end tests of all services together are slow, fragile and hard to maintain. Pact — the most well-known consumer-driven contract testing tool. Idea: consumer team describes their expectations from provider API in the form of a "contract" (pact file) — what requests they send and what responses they expect. This contract is published (in Pact Broker). Provider in their pipeline runs tests against all contracts of their consumers — and immediately sees whether their change broke any of them. At the same time services are tested separately (fast, stable), without raising the whole system. Why API QA: contract testing catches integration regressions early and cheaply, without fragile end-to-end tests; mature practice often implemented by QA engineers. In modern microservice products knowledge of Pact / contract testing — a strong skill of Senior API QA. Complements (doesn't replace) functional API testing and targeted end-to-end checks of key scenarios.

Yes, 38% of API QA vacancies — remote or hybrid, and this is one of the most remote-friendly QA specializations: all work with API, code, CI/CD and databases, physical presence not needed (unlike, for example, Mobile QA with device park). Russian product companies offer office, hybrid and remote. English — needed for international market, tool documentation and specifications. API QA + automation — good combination specifically for remote high-paid work.

API QA — practical and in-demand specialization, good entry into more "engineering" testing. Roadmap: 1) QA basics — test design, types of testing, bug reports. 2) HTTP — thoroughly: methods (GET / POST / PUT / PATCH / DELETE), status codes (2xx / 3xx / 4xx / 5xx), headers, cookies, request / response body; what REST is. 3) Postman — master as main tool: requests, environments, variables, collections, writing tests, running through Newman. 4) Formats and validation — JSON (and XML), JSON Schema, reading OpenAPI / Swagger specifications. 5) Authentication — OAuth 2.0, JWT, API keys, basic auth — how to test protected endpoints. 6) SQL — mandatory: check that the request correctly changed data in DB. 7) Programming language — for automation one needed: Java (then REST Assured) or Python (then pytest + requests). 8) API automation — write a set of autotests with the chosen framework, figure out fixtures, parametrization, reports. 9) CI/CD — running API tests in pipeline. 10) Advanced — mocks (WireMock), contract testing (Pact), GraphQL / gRPC. 11) Pet project: take an open API, write functional autotests, connect to CI. Resources: Postman documentation, learning APIs (e.g. open public APIs for practice), testing schools (Otus, «QA Automation» courses), books and materials on API testing. API Automation is valued noticeably higher than manual — move toward automation and master code.

16 active open jobs by exact term «API QA» in Zorky CRM sample. Real market significantly wider: API testing — mandatory part of most «QA Automation Engineer», «Backend QA», «SDET», «QA Engineer» vacancies at product companies; not always designated by separate term «API QA». Geography: Russia / remote / Poland. Demand is wide and stable — microservice architecture exists at almost every large product, and API testing became the core of automation. Time to fill Senior API Automation — 4-8 weeks. API testing skill — one of the most universally useful in QA: in demand in practically any QA role.

Senior API QA owns testing of software interfaces at engineering level. HTTP and protocols: deep understanding of HTTP, REST, GraphQL, gRPC (and SOAP in legacy), semantics of methods and status codes, caching, idempotency. API design: understanding of good API principles (versioning, pagination, error handling, consistency) — to see not only implementation bugs but design problems. Production-level automation: designing API autotest architecture (REST Assured / pytest / Karate), reusable layers (clients, request builders, checks), test data management, test isolation, fighting instability. Contract testing: Pact / consumer-driven contracts — for microservice integrations. Microservice testing: understanding what and at what level to check (testing pyramid), integration scenarios, mocks and stubs (WireMock), testing asynchronous interactions (queues, events). Specifications: OpenAPI / Swagger, schema validation, generative tests (Schemathesis). SQL and data: confident DB state checks, understanding of data integrity. Authentication and security: OAuth / JWT, basic API security testing (OWASP API Security Top 10). Programming: confident code in automation language, clean maintainable test code, code review. CI/CD: integration of tests in pipeline, test gates, parallel run, reporting. Infrastructure: Docker, environments understanding. Soft: mentoring, building API testing process in the team, communication with development. English — for international market and documentation. Senior API QA is essentially an engineer, and this specialization — one of the closest to backend development inside QA.