How would you test an order creation API?

Direct answer

What a strong answer covers

How it works

Testing a write endpoint starts from its contract and its side effects. The contract tests cover the successful request and response shape, every validation rule with boundary values, and the error schema for each failure. Security tests cover missing and invalid authentication and, more importantly, a valid user trying to create an order for another account. Business tests cover totals, taxes, discounts, and stock reservation against known fixtures. Reliability tests cover idempotency with a repeated key, two concurrent requests for the last unit of stock, a payment provider timeout, and a database failure mid-transaction to confirm nothing is half-written. Finally, the emitted events and persisted rows are asserted directly, and a load test checks latency at expected volume.

Example

The suite posts a valid order and asserts 201, the Location header, and the persisted row; posts a quantity of zero and a negative price and asserts 422 with field-level errors; replays the same idempotency key and asserts the same order ID; fires two concurrent orders for one remaining item and asserts exactly one succeeds; stubs the payment provider to time out and asserts the order stays in pending with no stock decrement; and checks that an order.created event was published with the right payload.

Common mistakes

• Testing only the happy path and the obvious validation errors.
• Skipping authorisation tests because authentication is covered.
• Never testing concurrency and shipping an oversell bug.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.