API learning path: from first GET to authenticated flows

Switch to API mode first: Mode > API Testing. The API panel is organized top to bottom the same way you will work: project and suite, Base URL, Discovery, Authorization, Suite Headers, Scenarios, Endpoints, Run.

SET UP THE PANEL (once per API project)
1. Base URL - set it first; endpoint paths are relative to it. For the practice lab: https://api.wsqdemo.com/api/v1
2. Discovery - two ways to get endpoints into the panel:
   - "Use OpenAPI Spec (URL or File)": paste a spec URL (practice lab: https://api.wsqdemo.com/api/openapi.json) or Load Spec File, then click Discover Endpoints.
   - No spec? "Discover from Base URL", or click Add Endpoint and define method + path by hand.
3. Authorization - paste your auth value (for the practice lab: Bearer wsq-demo-admin-token) and click Test Auth to confirm it works before running anything.
4. Suite Headers - add headers that every request needs (the practice lab validates a typed X-Tenant-Id header, so it is a good place to see this working).

RUN YOUR FIRST REQUESTS
5. In Endpoints, tick the calls you want (Select All / Select None help), tick the Scenario checkboxes, then Run Selected or Run All.
6. Scenarios are pre-built per endpoint: Happy Path plus negative cases - Missing Req Query, Invalid Query Type, Missing Body, Invalid Body, Missing Req Header, Invalid Header Type. A well-behaved API returns 2xx for the happy path and 4xx for each negative case.
7. Click Save Suite so the whole configuration becomes a repeatable regression pack.

LEARNING ORDER (one new concept per step)
1. Direct GET - the smallest successful call.
2. Direct POST with a JSON body - payload structure and status assertions.
3. GET with query parameters.
4. POST with query + body combined.
5. Token login - capture a token from an auth endpoint.
6. Bearer-token follow-up - reuse the captured token in the Authorization header.
7. OpenAPI/spec-driven requests - let the spec generate coverage.
8. A second real-world API - prove the pattern beyond the demo.

Practice lab notes: get a token four ways - the stable demo tokens (wsq-demo-admin-token / wsq-demo-user-token), POST /auth/login (admin/admin123), OAuth2 POST /auth/token (client wsq-admin / admin-secret), or the X-API-Key header. GET /auth/me is the Test Auth target. Explore everything first in Swagger at https://api.wsqdemo.com.

The public guide stays intentionally high level. Open the Intelligent Assistant for click-by-click instructions, learning order, and practice ideas.