What do you check when testing an API besides the response code?

When testing an API, besides checking the response code, it is important to verify:

• Response body: whether the structure and data match the expected format (JSON, XML, etc.).
• Response headers: correctness of Content-Type, CORS, authorization, and other headers.
• Response time: how quickly the API responds to ensure performance.
• Error handling: correctness of error messages and error codes for incorrect requests.
• Data validation: ensuring the API correctly handles boundary and invalid data.
• Security: checking authorization, authentication, and absence of data leaks.
• Idempotency and state: if applicable, verifying that repeated requests do not unexpectedly change the state.

Example of checking JSON response body using Python and requests:

import requests

response = requests.get('https://api.example.com/data')
assert response.status_code == 200
json_data = response.json()
assert 'id' in json_data
assert isinstance(json_data['items'], list)