Testing APIs by hand: curl and browser dev tools

MENU = {
    "espresso": {"name": "Espresso", "category": "coffee", "price": 120},
    "cappuccino": {"name": "Cappuccino", "category": "coffee", "price": 180},
    "cold-brew": {"name": "Cold Brew", "category": "coffee", "price": 220},
    "filter-coffee": {"name": "Filter Coffee", "category": "coffee", "price": 80},
    "masala-chai": {"name": "Masala Chai", "category": "tea", "price": 90},
    "croissant": {"name": "Butter Croissant", "category": "bakery", "price": 150},
    "banana-bread": {"name": "Banana Bread", "category": "bakery", "price": 130},
    "veg-sandwich": {"name": "Veg Grilled Sandwich", "category": "food", "price": 160},
}

MAX_QTY = 10


def calculate_total(items):
    """items is a list of dicts like {"item_id": "espresso", "qty": 2}."""
    if not items:
        raise ValueError("An order needs at least one item")
    total = 0
    for line in items:
        item_id = line["item_id"]
        qty = line["qty"]
        if item_id not in MENU:
            raise ValueError(f"Unknown item: {item_id}")
        if not 1 <= qty <= MAX_QTY:
            raise ValueError(f"Quantity must be between 1 and {MAX_QTY}")
        total += MENU[item_id]["price"] * qty
    return total


def is_valid_phone(phone):
    """Indian mobile number: 10 digits, starting with 6, 7, 8 or 9."""
    return len(phone) == 10 and phone.isdigit() and phone[0] in "6789"

from fastapi import FastAPI, HTTPException
from pydantic import BaseModel, Field

from pricing import MENU, calculate_total, is_valid_phone

app = FastAPI(title="Brew & Bean API")

ORDERS = {}
NEXT_STATUS = {"received": "preparing", "preparing": "ready", "ready": "picked_up"}


class Line(BaseModel):
    item_id: str
    qty: int


class NewOrder(BaseModel):
    customer_name: str = Field(min_length=1, max_length=50)
    phone: str
    items: list[Line]


class StatusChange(BaseModel):
    status: str


@app.get("/menu")
def get_menu():
    return [{"id": k, **v} for k, v in MENU.items()]


@app.post("/orders", status_code=201)
def create_order(order: NewOrder):
    if not is_valid_phone(order.phone):
        raise HTTPException(422, "Phone must be a 10-digit Indian mobile number")
    items = [line.model_dump() for line in order.items]
    try:
        total = calculate_total(items)
    except ValueError as err:
        raise HTTPException(422, str(err))
    order_id = f"ord-{1001 + len(ORDERS)}"
    ORDERS[order_id] = {
        "id": order_id,
        "customer_name": order.customer_name,
        "phone": order.phone,
        "items": items,
        "total": total,
        "status": "received",
    }
    return ORDERS[order_id]


@app.get("/orders/{order_id}")
def get_order(order_id: str):
    if order_id not in ORDERS:
        raise HTTPException(404, "Order not found")
    return ORDERS[order_id]


@app.patch("/orders/{order_id}/status")
def change_status(order_id: str, change: StatusChange):
    order = ORDERS.get(order_id)
    if order is None:
        raise HTTPException(404, "Order not found")
    allowed = NEXT_STATUS.get(order["status"])
    if change.status == "cancelled" and order["status"] in ("received", "preparing"):
        order["status"] = "cancelled"
    elif change.status == allowed:
        order["status"] = allowed
    else:
        raise HTTPException(409, f"Cannot move from {order['status']} to {change.status}")
    return order

python -m venv .venv
# Windows PowerShell:  .venv\Scripts\Activate.ps1
# Windows cmd:         .venv\Scripts\activate.bat
# macOS / Linux:       source .venv/bin/activate
pip install fastapi uvicorn
uvicorn main:app --reload

curl -i http://127.0.0.1:8000/menu

{
  "customer_name": "Asha",
  "phone": "9876543210",
  "items": [
    {"item_id": "espresso", "qty": 2},
    {"item_id": "croissant", "qty": 1}
  ]
}

curl -i -X POST http://127.0.0.1:8000/orders -H "Content-Type: application/json" -d @order.json

curl -i http://127.0.0.1:8000/orders/ord-1001

curl -i http://127.0.0.1:8000/orders/ord-9999

curl -i -X POST http://127.0.0.1:8000/orders -H "Content-Type: application/json" -d '{"customer_name":"Asha","phone":"12345","items":[{"item_id":"espresso","qty":2}]}'

curl -i -X PATCH http://127.0.0.1:8000/orders/ord-1001/status -H "Content-Type: application/json" -d '{"status":"ready"}'

I am learning API testing. Here is the request I sent and the response I got. Tell me in simple English what each part of the response means, whether anything looks wrong, and list 5 more tests I should try.

Request:
[paste your curl command]

Response:
[paste the status line, headers and body]