>_ Analyst Engineering

Learning path

APIs for Analysts

APIs for Analysts is a complete learning path for analysts, from absolute beginner to advanced. It starts with what an API is and your first request in Bruno or Postman, moves through analyzing, documenting, testing, and scripting APIs, and ends with design review, breaking changes, security testing, and CI release gates. Every article uses real, public APIs you can call today: GitHub, httpbin, and the Stripe sandbox.

Written by Ahmed at Analyst Engineering, a Senior Technical Business Analyst with 10+ years in banking and payments.

The core series, in 8 parts

If you prefer one continuous read, the eight-part series runs from first principles to proofs of concept. The tracks below add companion and reference articles at each level.

  1. 1.What Is an API? How APIs Actually Work, Explained for Analysts
  2. 2.Your First API Collection in Bruno and Postman: Requests, Environments, and Variables
  3. 3.How to Analyze an API: The Analyst's Method Before Anyone Writes Integration Code
  4. 4.How to Document an API: What Analysts Write So Developers Integrate Without a Call
  5. 5.How to Write API Test Cases: 40 Tests Derived From One Endpoint
  6. 6.Chaining API Requests With JavaScript in Bruno and Postman: The Scripts Analysts Need
  7. 7.API Proof of Concept: How Analysts Build POCs and Demos That Settle Decisions
  8. 8.The Analyst Who Can Send an API Request: Why Hands-On API Skill Is Your Edge

Beginner track

Understand and send your first requests

For you if: You have never called an API, or you only know APIs from specifications and diagrams.

By the end: You can explain how an API works, read a payload and a contract, send and save requests in Bruno or Postman, and fix the common errors yourself.

  1. 1 Series Part 1 What Is an API? How APIs Actually Work, Explained for Analysts What an API is and how one works, for analysts: request and response, methods, headers, auth, status codes, and a real GitHub API call you can send today.
  2. 2 API Glossary for Analysts: The Terms You Hear in Every Integration Meeting A plain-language API glossary for analysts: endpoint, payload, headers, tokens, idempotency, webhooks, pagination, and more, each with a real-world example.
  3. 3 JSON for Analysts: Read the Payload Fluently How an analyst reads JSON: objects, arrays, nesting, and types. Understand API payloads, event messages, and config files without asking a developer.
  4. 4 HTTP Status Codes Explained: What 200, 202, and 409 Really Mean An analyst's guide to HTTP status codes: the 2xx, 4xx, and 5xx families, what each common code means, and why 202 Accepted vs 200 OK matters in payments.
  5. 5 Series Part 2 Your First API Collection in Bruno and Postman: Requests, Environments, and Variables Build a first API collection in Bruno and Postman: environments, variable precedence, inherited auth, secrets in .env or a vault, and cURL imports.
  6. 6 Why Did My API Request Fail? Troubleshooting Your First API Calls Troubleshoot failed API requests by symptom: connection and SSL errors, 401 vs 403, wrong-URL 404s, 415 and 422, 429, 5xx, CORS, and unresolved variables.
  7. 7 Reading an API Contract: OpenAPI Without a Developer How an analyst reads an API contract: endpoints, methods, request and response schemas, status codes, and OpenAPI structure, without asking a developer.
  8. 8 Series Part 8 The Analyst Who Can Send an API Request: Why Hands-On API Skill Is Your Edge Why analysts who send, chain, and script API requests move faster: verified requirements, reproducible defects, faster triage, credible POCs, and a 30-day plan.

Intermediate track

Analyze, document, test, and script

For you if: You can send requests and want to use APIs in real analysis, specification, and testing work.

By the end: You can evaluate an API against a process, document it for consumers, derive a full test suite, chain and script flows, and handle webhooks and GraphQL.

  1. 1 Series Part 3 How to Analyze an API: The Analyst's Method Before Anyone Writes Integration Code A method for analyzing an API before integration: capability mapping, field-level data mapping, failure behavior, limits, versioning, and a fit-gap worksheet.
  2. 2 How to Write API Requirements That Developers Can Actually Build How to write API requirements: endpoint, method, request and response schema, status codes, error contracts, and testable acceptance criteria. With examples.
  3. 3 Series Part 4 How to Document an API: What Analysts Write So Developers Integrate Without a Call How to document an API as an analyst: the seven sections consumers need, an OpenAPI endpoint example, an error catalogue, flow guides, and docs you can test.
  4. 4 API Keys, PATs, and OAuth Tokens: The Analyst's Guide to Credentials The difference between an API key, a personal access token, and an OAuth token, how to scope and rotate them, and where they belong across an analyst toolchain.
  5. 5 Series Part 5 How to Write API Test Cases: 40 Tests Derived From One Endpoint How to write API test cases from the contract: a six-source derivation method, 40 worked cases for one payment endpoint, and data-driven automation in Bruno.
  6. 6 Series Part 6 Chaining API Requests With JavaScript in Bruno and Postman: The Scripts Analysts Need Chain API requests in Bruno and Postman: capture values, pre-request and post-response scripts, token refresh, polling, branching, and a Stripe sandbox flow.
  7. 7 Idempotency Testing: Proving Duplicate Requests Are Safe How to test idempotency in APIs and event consumers: idempotency keys, duplicate requests, redelivered events, and race conditions behind double processing.
  8. 8 Webhooks Explained for Analysts: How to Specify, Test, and Debug Them How webhooks work and what analysts must specify: events, signatures, retries, duplicates, and ordering, plus testing with webhook.site and the Stripe CLI.
  9. 9 GraphQL for Analysts: How to Read, Query, and Test a GraphQL API GraphQL for analysts: queries, variables, mutations, errors returned with HTTP 200, cursor pagination, and hands-on testing of the GitHub GraphQL API in Bruno.

Advanced track

Prove, protect, and scale

For you if: You already test and script APIs and want to shape designs, guard releases, and lead integration decisions.

By the end: You can run POCs that settle decisions, review designs and contract upgrades before build, manage breaking changes, describe workflows in Arazzo and events in AsyncAPI, fuzz and load test against the contract, test authorization against the OWASP API Top 10, and gate releases in CI.

  1. 1 Series Part 7 API Proof of Concept: How Analysts Build POCs and Demos That Settle Decisions How an analyst builds an API proof of concept: the decision it must settle, a two-day spike, mocks from OpenAPI, webhook proof, a scripted demo, and evidence.
  2. 2 API Design Review: The Analyst's Checklist Before the Contract Is Frozen How analysts review an API design before build: domain naming, state changes, money and dates, error model, pagination, idempotency, and a worked review.
  3. 3 Stripe PaymentIntents API Review: 22 of 24 on the Scorecard, and the 12 Findings Your Integration Must Own Stripe's PaymentIntents API scored on a 12-check contract review: 22 of 24, plus the idempotency, webhook, versioning, and lifecycle findings teams must own.
  4. 4 OpenAPI 3.1 and 3.2 for Analysts: What Changed and What to Check on Upgrade What changed from OpenAPI 3.0 to 3.1 and 3.2, from nullable to type arrays, webhooks, QUERY and streaming, and what to check when a provider upgrades.
  5. 5 API Versioning and Breaking Changes: How Analysts Assess Impact Before a Release What counts as a breaking API change, versioning strategies, Deprecation and Sunset headers, detecting breaks with oasdiff, and consumer impact assessment.
  6. 6 Contract Testing: Catch Breaking Changes Before They Ship What contract testing is, how it differs from integration testing, and how consumer-driven contracts catch breaking API and event changes before production.
  7. 7 Arazzo for Analysts: Multi-Step API Workflows as Testable YAML The Arazzo Specification for analysts: sourceDescriptions, steps, successCriteria, and runtime expressions, with a Stripe payment-to-refund workflow to run.
  8. 8 Schemathesis API Fuzzing: Property-Based Tests From Your OpenAPI Contract Fuzz an API from its OpenAPI contract with Schemathesis 4: run command, checks, negative and stateful tests, JUnit in CI, and triaging findings into defects.
  9. 9 API Security Testing for Analysts: The OWASP API Top 10 as Test Cases The OWASP API Security Top 10 (2023) as test cases analysts can run in Bruno or Postman: object and field authorization, auth, limits, business flows, and more.
  10. 10 Open Banking APIs for Analysts: Consents, SCA, FAPI 2.0, and the Rules by Market in 2026 Open banking APIs for bank analysts: AIS vs PIS, the consent lifecycle, SCA, FAPI 2.0, PSD3, UK, US 1033, and Canada status, plus the test cases that matter.
  11. 11 API Performance Testing With k6: From the NFR to the Load Test Load test a payments API with Grafana k6 v2: write the NFR first, then scenarios, thresholds, and checks, safe idempotency keys, test types, and a CI run.
  12. 12 API Observability Requirements: SLOs, Log Fields, Metrics, and Alerts an Analyst Writes The observability requirements an analyst writes for a payment API: golden signals, SLOs and error budgets, log fields, metrics, alerts, and Gherkin checks.
  13. 13 Running API Tests in CI: Bruno CLI, Postman CLI, and Newman in GitHub Actions Run API test collections in CI with Bruno CLI, Postman CLI, or Newman in GitHub Actions: secrets, tags, JUnit and HTML reports, private networks, flaky tests.
  14. 14 Postman CLI vs Newman: Running Postman Collections in CI in 2026 Postman CLI vs Newman in CI: install and run commands, JUnit reports, spec linting, where results go, GitHub Actions YAML, and the git-native Bruno CLI.
  15. 15 AsyncAPI 3.0 for Analysts: Reading and Reviewing a Kafka Event Contract How to read and review an AsyncAPI 3.0 contract for Kafka: channels, operations, messages, bindings, keys, ordering, and schema registry compatibility.
  16. 16 How to Test Kafka: Validating Events You Cannot See A guide to testing Kafka: consuming events in a test, asserting schema and key, verifying ordering and duplicates, and checking consumer side effects.
  17. 17 Automating Kafka Validation in Postman: Collections, Scripts, and a CI Gate Turn manual Kafka checks into an automated Postman collection: produce and consume over REST Proxy, poll with backoff, assert schema and ordering, run in CI.

Go further

Guides and 1:1 coaching

The full playbooks behind this path, and a direct line if you want help applying it to the APIs on your own project, at whatever level you are.

API Testing and QA Mastery API Documentation from Scratch Book a 1:1 coaching call

34 articles across three levels.

Free account

Practice on a real API

Mission 01 of the Labs hands you an OpenAPI contract, requirements, and sample responses to find the gaps. A free account saves your progress and can email you the next playbook.

Your email is used to sign you in. Nothing else, unless you ask. Privacy.