Client-Server Architecture and API Testing 2.0
CSA & API Testing
An original course that finally makes the confusing parts make sense — once and for all.
See what the course is about
What makes this course different
A large block on architecture
Typical API courses focus on Postman and HTTP. But an API is more than that. To understand the essence, you have to separate it from the protocols and master the foundation of software — architecture.
An ecosystem of materials
All the learning lives on an LMS platform: lessons, quizzes, homework and extra materials in one place, with your course progress visible at a glance.
Docker & Git
Besides Postman and Swagger, we work with Git and Docker — a useful addition to your CV.
Materials forever
I do not limit access to the materials, and you also get every future update to the course.
Varied homework
I balance the load from lesson to lesson, so the assignments really do differ: quizzes, building a project, writing scenarios and checklists, covering an API with automated tests. There are also extra hardcore-level tasks ;)
Constant support
I am always in touch with students — happy to discuss the course as well as real cases from practice. Support is both technical and human. There is also student care on the course: Alina is there for any question.
Ten lessons, a bonus and an AI track
From how the internet works to API tests in a pipeline. Every topic is followed by quizzes and hands-on practice on KVYT, the course's own training project; between lessons there are live Q&As and ongoing support in the chat.
What goes on your CV after the course
- Chrome DevTools
- HAR
- curl
- Postman
- Bruno
- Swagger UI
- OpenAPI 3.x
- JSON Schema
- Schemathesis
- JWT
- OAuth2
- Docker
- docker compose
- RabbitMQ
- pytest + httpx
- Postman CLI
- GitLab CI
- k6
We practise on KVYT, the course's own training project with planted defects. It runs in Docker on your laptop, so you can break it as often as you like.
Core programme
From internet architecture to API tests in a pipeline
Lesson 1: Foundations4 topics
- How the internet works: cables, providers, exchange points, a request's path to the server
- IP, DNS and ports: public and private IPs, subnets, NAT; why localhost is not a website
- Anatomy of an HTTP request and response: URI, URL vs URN, query parameters
- What an API is, and why QA work does not start with a tool
- A quiz after every topic
- Homework 1, reviewed by a curator: IP and the structure of an HTTP message
You understand what happens between the browser and the server, and you talk to developers in the same terms: address, port, request, response.
Lesson 2: Architecture6 topics
- Docker in 20 minutes: start someone else's project, read the logs, stop it
- Client and server: physical server, app server, web server; thin and thick clients
- Tiers: 2-tier, 3-tier, N-tier, and where the business logic lives
- Load balancer, reverse proxy, API gateway, and why 502 and 504 are about them
- Monolith, microservices, serverless: what changes for a tester
- Reading an unfamiliar system: docker-compose, logs, health checks, a service map
- Run the KVYT training project in Docker
- Draw a service map of an unfamiliar system
You read an architecture diagram and a compose file, see the system's boundaries and know which service to look in for the cause of a bug. You speak the same language as developers, DevOps engineers and architects.
Lesson 3: HTTP5 topics
- Methods and semantics: safe and idempotent, PUT vs PATCH, what happens when a POST is repeated
- Status codes in the pairs people mix up: 401 and 403, 301 and 302, 500, 502 and 504, 409 and 422
- Headers, body and cookies: Accept vs Content-Type, HttpOnly, Secure, SameSite
- Caching:
Cache-Control,ETag,If-None-Match, 304, private and shared caches - Intercepting traffic in DevTools: request blocking, Local Overrides, HAR in a bug report
- Find an HttpOnly cookie and a cached request in DevTools
- “HTTP hunt”: work through a checklist on KVYT and find the planted defects
You see more in a response than “200 OK”: whether the system kept the promise of its method, code and headers. And you collect evidence for the bug report straight from the browser.
Lesson 4: The API contract7 topics
- Your first request three ways: Postman, Bruno and curl
- What REST really is: principles, maturity levels, pagination, filtering, sorting
- API types: REST, GraphQL, gRPC, WebSocket, and what changes when testing each
- Documentation as a product: why it lies and how to read it critically
- OpenAPI 3.x and Swagger: components, security schemes, versioning and backward compatibility
- JSON Schema: read it, write it by hand, validate responses in Postman and Bruno
- Generating tests from a spec: Schemathesis in Docker and the property-based approach
- Find mismatches between KVYT's OpenAPI spec and its implementation: by hand with a checklist and with Schemathesis
You start testing an API from its documentation: you spot where the contract and reality diverge, and you check responses against a schema rather than by eye.
Lesson 5: Postman and Bruno5 topics
- From smoke to regression: scenarios instead of single requests, the happy path and negative branches
- A collection as a working artefact: environments, variables, Postman cloud, Git and Bruno files
- Chains and pre-request scripts: passing ids and tokens between requests, auth without a manual token
- Checks in JavaScript: status, fields, business rules; generating tests with Agent Mode
- A regression run: Collection Runner, data-driven testing from CSV, reading the report
- A KVYT regression collection with a run and a report
Lesson 6: Authorisation4 topics
- Identification, authentication, authorisation: 401, 403 or 404 for someone else's object
- Kinds of auth: Basic, API key, Bearer, OAuth2 (roles, scopes, Authorization Code + PKCE, Client Credentials) and where to keep secrets
- JWT in essence: structure, claims, expiry, refresh flow, testing token expiry
- Roles and a “role × endpoint” access matrix as a test artefact
- KVYT's access matrix, token checks and two bug reports
- Negative cases for every cell of the matrix, with help from AI
You test access systematically rather than “logged in, it works”: who can do what, what happens with an expired token and where the server hands out someone else's data.
Lesson 7: Test analysis3 topics
- What the test object is in an API: endpoint, resource, flow, and which bugs each level catches
- Strategy: what to check through the API, what through the UI and what not to test; a one-page strategy
- Decomposing an API in a mind map: breadth first, stop by risk, then depth, and how a checklist grows from the map
- Test analysis of KVYT bookings: the map, state transitions, gaps in the requirements
- Review your analysis with AI, confirming every remark with the spec or a request
You have a strategy for where to start testing any API, and you can turn it into a checklist instead of a set of random requests.
Lesson 8: Asynchronous systems4 topics
- Message broker: producer, queue, consumer, ack — and the RabbitMQ dashboard live
- Waiting without sleep: eventual consistency, checks with retries and a timeout, duplicates from redelivery
- Tracing: follow a trace_id through every service's logs to find where a request got lost
- One service is down: what the client sees — 503 vs 504,
/health/ready, failure, cascade, deferred or lost
- Module quiz after the topics
- Homework 8: check KVYT notifications with retries and find two defects with a trace_id and logs
- Dependency table: what the client sees when the broker or the notification service goes down
You understand how services exchange messages, check an asynchronous result without sleep, and use a trace_id to show which service lost the request.
Bonus: Idempotency1 topic
- What idempotency really is, and three myths around it
- The safe / idempotent / cacheable table and RFC 9110
- Why POST is not idempotent out of the box, and how
Idempotency-Keyhelps
- A safe / idempotent / cacheable table for every KVYT endpoint, based on the implementation rather than expectations
Lesson 9: API tests in code3 topics
- The limit of a tool: when a collection is no longer enough and you need code
- The same scenario in code: pytest + httpx, follow-along style
- Preparing data through the API and isolating tests
- Move your own happy path into pytest + httpx
Lesson 10: CI/CD4 topics
- Why CI/CD, and where tests belong in a pipeline
- What QA runs in a pipeline: Postman CLI, artefacts, a quality gate
- Logs, metrics, traces: a bug report with a trace_id
- Flaky tests in CI and basic performance testing with k6
- Add your tests to the KVYT pipeline and set up a quality gate
Who this course suits
QA looking for a job
You finished a testing course but never really got APIs, and you lack the hard skills to land a QA role.
Experienced QA
You want to understand different API testing strategies, deepen your technical knowledge, try new tools, work more effectively and make deliberate decisions.
Other IT specialists
PMs, POs, BAs and anyone else who wants a better overall grasp of the subject.
Inna Osinna
QA Team Lead / Senior Manual QA
My background is fairly broad by now: quality of products and processes, management, testing, teaching; experience with native apps and the web, with a startup and with large-scale business, with UI and with databases.
Having walked that path, I can say with confidence that without understanding how an application is built inside, it is very hard to be an effective engineer. That is why this course is not about poking requests in Postman — it is about UNDERSTANDING what to poke, where, and whether you should.
This is the product I badly missed myself. A product that would have let me feel confident in engineering syncs, understand developers and architects, propose improvements to the project's architecture, and start testing an API from its documentation. And confidently put “client-server architecture” and “API testing” on my CV without dreading interviews.
How the course runs
- Lessons 1–2Foundations and architecture
Live Q&AHomework and questions
- Lessons 3–4HTTP and the API contract
Live Q&AHomework and questions
- Lessons 5–6Postman and Bruno, authorisation
Live Q&AHomework and questions
- Lessons 7–8Test analysis and asynchronous systems
Live Q&AHomework and questions
- Lessons 9–10API tests in code and CI/CD
Live Q&AHomework and questions
- +2 monthsTo finish the homework
What graduates say
400+ QA engineers have taken the course. Here is how it changed their work and their careers.
Choose your format
Self Progress
≈ UAH 13,750 (depends on the exchange rate at the time of payment)
- Video lessons
- Notes and a glossary base
- Homework without review
- 6 months of access, outside the group schedule
Progress
≈ UAH 18,600 (depends on the exchange rate at the time of payment)
- Video lessons
- Notes and a glossary base
- Homework with review
- A library of supplementary materials
- A private chat with support
- 5 group Q&A sessions
- LIFETIME access to the materials
Job Offer
≈ UAH 24,800 (depends on the exchange rate at the time of payment)
- Everything in Progress
- A mock interview with Inna Osinna (2 hours)
- An AI chatbot for interview preparation
- A detailed CV review
- The full list of interview preparation questions
How to pay
Full payment
Made through the payment provider. There you can also split the payment into instalments over up to 10 months with no fee.
Reservation
Made through the payment provider. A reservation secures your seat in the next group and the price valid at the moment of booking. You can pay the rest at any time before the course starts, and that balance can be split into instalments too.
Frequently asked questions
Is there a certificate?
Yes. Every student who completes at least one homework assignment receives a certificate at the end of the course.
What will I get out of the course?
API testing stops being scary. You will always have a strategy ready — where to start. You will adjust that strategy based on what you know about architecture, API types and the nuances of HTTP. The test artefacts you receive and write during the course (checklists, test scenarios) stay with you for real projects. And interviews become far less intimidating 😉
Are there deadlines for homework?
There are no hard deadlines — do the homework when it suits you. That said, I recommend finishing the homework for those lessons before our live session so it is more useful. The one deadline for submitting homework for review is 2 months after the last lesson. After the course you can buy an extension of the review if you need it.
How and where does the learning happen?
Video lessons are released weekly. Lessons, quizzes and homework are on an LMS platform, along with the schedule of lessons, online meetings and the final homework deadline. There is also a Telegram chat with announcements, useful links and direct access to me. Homework instructions are attached to every lesson. After the course ends you have 2 more months to finish and submit everything.
What kind of homework is it?
The assignments vary. In the early modules I use quizzes to consolidate the material (students get genuinely sad when they run out). Beyond quizzes, every lesson has practical tasks that grow in complexity and volume as the course progresses: writing JSON to a spec, building a project with Docker, creating test scenarios, writing automated tests for specific requests.
Will I be able to review the materials after the course?
Yes. Access to the materials is permanent.
Can I pay in instalments?
Yes. The payment provider offers many instalment options — pick whichever bank suits you and spread the payment over up to 10 months. You will not be charged a fee for it.
Which API will we be testing?
We work with KVYT, my own project built specifically for teaching, with defects planted in advance. It runs in Docker on your computer. It will not be the pet store or testrail that most courses use — I try to keep the course close to real life.
Can I get an invoice so my company covers the course?
Yes. I am always happy to help arrange this. Leave a request through the form below with the details you need for reimbursement — I will prepare everything and get in touch on Telegram.
How long does the course last?
10 weeks. After that I give another 2 months of buffer time to finish the homework. The group's calendar of all events and deadlines is on the LMS platform.
Do I need to install anything beforehand?
No. All the software can be installed as you go — every link is in the lesson instructions. But you can get ahead and download Docker, Postman and Bruno in advance.
Is the course suitable for a complete beginner?
Ideally the course is designed for QA already working in the field. If you have no experience yet but have finished a testing course and are looking for more depth, it will work — it may just feel a bit harder. If in doubt, write to me and I will advise you specifically.
Enrol on the course
Leave your contacts — our manager will get in touch, answer your questions and help with payment.