API and SQL testing in production systems

API and SQL testing in production systems

A green UI is a weak promise. I spend a large part of my testing time behind the screen: REST payloads, status codes, JSON and XML contracts, and the SQL that proves the backend actually changed.

Python, Postman, Swagger, and direct database checks are the daily toolkit. When an API says a record was created, I want the row, the log line, and the downstream dashboard to agree. That habit caught data mismatches that never appeared in the happy-path click-through.

A practical sequence

1. Read the contract. If Swagger and the implementation disagree, that is already a defect.
2. Exercise auth, validation, and error paths, not only 200 OK.
3. Confirm persistence with SQL and log analysis.
4. Automate the boring checks so exploratory time stays on risk.

This is also where Linux, DevTools, Charles Proxy, and Wireshark earn their keep. Network and backend evidence beats a screenshot of a spinner.