- Verify that endpoints return correct status code and data - Test edge cases (invalid input or unauthorized access)