Part 9: Advanced Playwright API Testing Techniques for Enterprise Automation

Introduction

At this point, you've built a professional Playwright API automation framework that includes enterprise folder structure, Service Layer, API Clients, Authentication, Environment Management, Schema Validation, Test Data Management, Logging, Reporting, and CI/CD Integration.

This is already more advanced than what many automation engineers use in production. However, senior SDETs and Test Automation Architects are expected to go beyond simple CRUD testing.

Modern enterprise applications require advanced API automation techniques such as API Chaining, File Upload & Download, Multipart Form Data, OAuth 2.0, GraphQL, WebSocket Testing, Database Validation, UI + API Hybrid Automation, and Contract Testing. These are the topics that separate intermediate automation engineers from senior-level professionals.

In this chapter, we'll explore these advanced techniques.

API Chaining

One API often depends on another. For example, a typical workflow might be: Login → Receive Token → Create Customer → Receive Customer ID → Create Order → Receive Order ID → Verify Order. This process is known as API Chaining.

The response from one API becomes the input for another.

Example: Create User → Retrieve User

const createResponse = await request.post("/users", {
    data: {
        firstName: "John",
        lastName: "Doe"
    }
});

const createdUser = await createResponse.json();
const userId = createdUser.id;

const getResponse = await request.get(`/users/${userId}`);

expect(getResponse.status()).toBe(200);

Notice how the User ID generated by the first API is reused by the second API. This is a common enterprise testing pattern.

API Chaining Best Practices

Instead of writing everything in one test, move business workflows into the Service Layer.

const customer = await customerService.createCustomer();
await orderService.createOrder(customer.id);

Your tests remain short, readable, and reusable.

Testing File Upload APIs

Many enterprise applications allow users to upload profile photos, PDF documents, Excel files, CSV files, images, and contracts. Playwright supports multipart file uploads.

const response = await request.post("/upload", {
    multipart: {
        file: {
            name: "resume.pdf",
            mimeType: "application/pdf",
            buffer: buffer
        }
    }
});

Always verify that the upload succeeds, the file size is correct, the file type is correct, the file name matches expectations, and the server response contains the expected metadata.

Testing File Download APIs

Some APIs generate downloadable files such as reports, invoices, CSV exports, audit logs, and PDFs. Instead of validating only the status code, verify the file exists, the file name is correct, the content type is correct, the file size is reasonable, and the file content matches expectations.

const response = await request.get("/reports");

expect(response.status()).toBe(200);

const file = await response.body();

expect(file.length).toBeGreaterThan(0);

Multipart Form Data

Not every API accepts JSON. Some require multipart requests, which are commonly used for document management systems.

await request.post("/documents", {
    multipart: {
        title: "Automation Guide",
        category: "Testing",
        file: {
            name: "guide.pdf",
            mimeType: "application/pdf",
            buffer: pdfBuffer
        }
    }
});

OAuth 2.0 Authentication

Many enterprise applications integrate with Google, Microsoft, GitHub, Salesforce, or Okta using OAuth 2.0. The typical flow is: Client → Authorization Server → Access Token → Protected API.

Once the Access Token is received, send it in the Authorization header.

Authorization: Bearer ACCESS_TOKEN

Usually, automation frameworks obtain this token through a setup utility or authentication service rather than performing the full browser login flow for every test.

GraphQL API Testing

Not every application uses REST APIs. Modern applications increasingly use GraphQL, which exposes a single endpoint where clients specify exactly which data they want.

query {
    user(id: 1) {
        id
        firstName
        email
    }
}

Playwright sends GraphQL requests exactly like any other POST request.

await request.post("/graphql", {
    data: {
        query: graphqlQuery
    }
});

Validation remains the same.

WebSocket Testing

Some enterprise applications use WebSockets for real-time communication. Common examples include stock trading platforms, chat applications, online gaming, and live dashboards. Unlike REST APIs, WebSockets maintain an open connection.

The typical flow is: Client → Open Connection → Receive Messages → Close Connection. Although WebSocket testing often requires additional libraries depending on your application, Playwright can still be part of an end-to-end testing strategy that verifies the UI updates correctly after real-time events.

Database Validation

Sometimes validating the API response isn't enough. For example, after POST /users returns 201, you may want to verify the database record. Many enterprise projects verify that data is inserted correctly, stored procedures executed, audit tables updated, and business rules applied.

const dbUser = await database.getUser(id);

expect(dbUser.email).toBe(request.email);

Database validation increases confidence that backend operations completed successfully.

API + UI Hybrid Testing

One of Playwright's greatest strengths is combining API and UI testing in the same framework. A typical workflow might be: Create Customer via API → Login to UI → Search Customer → Verify Customer Appears → Delete Customer via API → Verify Customer Removed.

Benefits include faster execution, less UI setup, more reliable tests, and better end-to-end validation. Enterprise teams frequently use APIs to prepare test data before validating it through the user interface.

Contract Testing Concepts

As systems evolve, APIs change. Unexpected changes can break consumers. Contract testing helps verify that APIs continue to return expected structures. Examples include checking required fields, data types, response structure, optional fields, and backward compatibility.

Even if you're not using a dedicated contract-testing tool, combining schema validation with version-aware testing can significantly reduce integration issues.

Rate Limiting

Some APIs enforce request limits. A common response is 429 Too Many Requests. Your automation framework should respect API limits, retry only when appropriate, avoid sending unnecessary requests, and support configurable wait strategies. Never overwhelm production systems with aggressive automated execution.

Idempotent APIs

Understanding idempotency is important for API automation. HTTP methods behave differently when retried.

Method    Idempotent?
GET       Yes
PUT       Yes
DELETE    Yes (typically)
POST      No
PATCH     Usually No

Knowing this helps you design reliable retry strategies. For example, automatically retrying a POST request could unintentionally create duplicate records unless the API supports idempotency keys.

Enterprise Best Practices

Experienced automation engineers follow these guidelines:

• Use API chaining instead of hardcoded IDs.
• Upload and validate files using multipart requests.
• Validate downloaded files.
• Verify database updates after critical operations.
• Use APIs to prepare test data for UI automation.
• Keep GraphQL queries organized in separate files.
• Respect API rate limits.
• Validate API contracts regularly.

Common Beginner Mistakes

Avoid these common issues:

• Hardcoding generated IDs.
• Ignoring database validation.
• Validating only HTTP status codes.
• Uploading files without checking server responses.
• Mixing GraphQL and REST request logic.
• Assuming every API uses JSON.
• Retrying non-idempotent requests without safeguards.

Interview Questions

What is API Chaining?

API Chaining is the process of using data returned from one API request (such as an authentication token or resource ID) as input for subsequent API requests to validate complete business workflows.

Why combine API and UI automation?

API automation creates or prepares data much faster than UI automation. Combining APIs with UI validation reduces execution time while still verifying the complete user experience.

What is the difference between REST and GraphQL?

REST typically exposes multiple endpoints, each representing a resource. GraphQL usually exposes a single endpoint where clients specify exactly which data they want, reducing over-fetching and under-fetching.

Why validate the database after an API call?

Validating the database ensures that backend operations completed successfully and that the data persisted correctly, providing stronger confidence than checking the API response alone.

Summary

Excellent work! You now understand many of the advanced API automation techniques used in enterprise environments.

In this chapter, you learned:

• API Chaining
• File Upload APIs
• File Download APIs
• Multipart Form Data
• OAuth 2.0 Concepts
• GraphQL Testing
• WebSocket Testing Concepts
• Database Validation
• API + UI Hybrid Testing
• Contract Testing Concepts
• Rate Limiting
• Idempotency
• Enterprise Best Practices

What's Next?

In Part 10 (Final Part), we'll bring everything together by building a complete Enterprise Playwright API Automation Framework from scratch. You'll learn how to structure the project, integrate reusable components, generate professional reports, organize CI/CD pipelines, and apply coding standards used by top technology companies. We'll also cover framework optimization, scalability, and interview tips for senior SDET and Test Automation Architect roles.