Skip to content
CodeKruPro

Headers Specification

40/62

Headers Specification

You can add default headers to a spec, so every request using it includes them:

RequestSpecification spec = new RequestSpecBuilder()
    .setBaseUri("https://testkru.com/api")
    .addHeader("Accept-Language", "en-GB")
    .build();

The header name and key the endpoint expects are in the starter code.

Task: Create a spec with the API key header and use it to access /auth/apikey.

Expected output:

Message: Valid API key

About this lesson

REST Assured RequestSpecification with default headers for API key auth

Learn REST AssuredIntermediateRequest Specification

How it works

Credentials are the most common thing to put in a request specification, because nearly every call to a protected service needs them and repeating the header in each test is noise. RequestSpecBuilder has addHeader(name, value) for one header and addHeaders() for a map, and everything you add rides along with each request that uses the spec.

The testkru /auth/apikey endpoint expects the X-API-Key header. HTTP header names are case insensitive, so the server reads it regardless of capitalisation, but the value must match exactly. With the right key the answer is 200 and a JSON object with message and key. With a wrong or missing key it is 401 and an error text that tells you which header to send. REST Assured does not throw on that 401, so a missing header shows up only when you check the status or read the body.

Authentication routes on this API share a tighter rate limit than the rest: counted per client IP under /auth/. If you ever see 429 instead of 200, the server is asking you to slow down, not reporting a bug in your spec.

About the assignment

Put the base URI and the API key header into one request specification, then call the key-checking endpoint with it and report the server's message.

What you will do

  1. Create a RequestSpecBuilder and set the base URI with setBaseUri().
  2. Add the X-API-Key header with the key from the starter comment using addHeader(), then call build().
  3. Apply the spec with given().spec() and GET /auth/apikey.
  4. Read the message field with getString() and print it after Message:.

Common mistakes

  • Sending the key in the Authorization header

    This endpoint does not look at Authorization. A key placed there is ignored and the answer is 401. Use the header name the API documents.

  • Reading key instead of message

    The success body contains both key (an echo of what you sent) and message. Printing key shows your own value back, which proves nothing about whether the server accepted it.

  • Retrying in a tight loop on 429

    Hammering the auth route after a rate-limit response only keeps you blocked. Wait for the one-minute window to pass, and in real suites avoid logging in or checking keys more often than needed.

In a real test suite

Teams keep the key out of source code: the spec reads it from an environment variable at startup, and the build fails early with a clear message if it is missing. A second, deliberately empty spec is handy for negative tests that prove each protected endpoint answers 401 without the header.

Related lessons

To try one of these calls on any API endpoint without a task, open the Online Selenium Java Compiler (REST Assured is included).

Starter code

The editor above opens with this code. Fill in the TODO lines, then run and submit it.

Main.java
import io.restassured.RestAssured;
import io.restassured.response.Response;
import io.restassured.specification.RequestSpecification;
import io.restassured.builder.RequestSpecBuilder;
import static io.restassured.RestAssured.*;

public class Main {
    public static void main(String[] args) {
        // TODO: Create a RequestSpecification with:
        //   - baseUri: "https://testkru.com/api"
        //   - header: X-API-Key = "testkey123"
        // TODO: Use spec to GET /auth/apikey
        // TODO: Print the message field
    }
}
Next lessonCombined SpecificationAll lessons in the courseLearn REST Assured