What should an API test cover beyond the HTTP status code?

Check response schema, field types, required values, authorization, relevant headers, and persistent side effects. For an order API, confirm the correct account owns the order, totals match server rules, and retry behavior does not duplicate it. Include malformed input, missing authentication, cross-account access, and relevant concurrency cases. Verify errors are useful without exposing secrets or stack traces. A 200 response can still contain the wrong data, and a correct error status can still accompany an unintended database write.