REST Assured is the library that made API testing in Java pleasant. Before it arrived, calling an HTTP endpoint from a Java test meant a lot of boilerplate around connections, streams and JSON parsing. REST Assured wraps all of that in a fluent given, when, then syntax that reads almost like a sentence, and it plugs into the test runners Java developers already use. In this project it runs on TestNG.
How it works
You describe a request, fire it, and assert on the response in one readable chain. The library sends the HTTP call, parses the body and lets you assert on it with Hamcrest matchers, including JSON path expressions that reach straight into the response:
given()
.when()
.get("/brands")
.then()
.log()
.ifValidationFails()
.statusCode(HttpStatus.SC_OK)
.and()
.body("data.size()", greaterThanOrEqualTo(2));
The base URI is set once in a shared base class, so individual tests only mention the path. For authenticated flows a test logs in, extracts the access_token from the response, and passes it as an OAuth2 bearer on the next call. TestNG handles the lifecycle, so a @BeforeMethod can perform the login before each protected test. The build runs through Maven with mvn test, and Spotless keeps the formatting consistent.
Benefits
The syntax is expressive and easy to read, which lowers the cost of maintaining a suite over time. Because tests are ordinary Java, you get everything the language and its tooling provide: real modules, shared helpers, an IDE with refactoring, and dependency management through Maven. It fits naturally into an existing Java project, so backend developers can test their own endpoints without adopting a separate stack. The Hamcrest matchers make body assertions precise.
Downsides
You need a Java toolchain and some comfort with the language, so it is a bigger step for a tester coming from a graphical client. The fluent chains are elegant for simple cases but can become hard to read when a single test tries to do too much. Compilation and JVM startup make the feedback loop slower than a lightweight scripting approach. For a Java team these costs are usually worth it, but they are real.
What the example project tests
The repository at github.com/testsmith-io/api-test-automation-java-testng-restassured tests the Practice Software Testing API at https://api.practicesoftwaretesting.com, the ToolShop backend used throughout this series. The base URI is configured in a TestBase class.
Three scenarios are covered. A brands test calls GET /brands and asserts status 200 with at least two entries. A login test posts credentials to /users/login and checks for a 200 and an access_token. A protected invoices test logs in through a TestNG setup method, extracts the token, calls GET /invoices with a bearer, and asserts a healthy list of invoices. A GitHub Actions workflow runs mvn spotless:check and mvn clean test on push and on a weekly schedule, then publishes the Surefire report. The same three checks appear here as they do in every other example, which lets you weigh the readability of REST Assured against the lighter tools.