java – What to test when testing an API?

When testing an API (with, for example, Java), which parts should I test when calling methods from my Controller class (for example, a Spring class)? RestController)?

For example, let's say I have a s & # 39; identify method in my controller.
This method calls some methods from another class (that is, my class of service), to finally return a connection token / session / …

Should I now only test if the response I send to customers is valid, ie it contains headers, cookies, etc.? correct, or if I had to test whether the connection token / session / other-thing-which-has been made the class of service is also valid?

(I imagine that these tests would go into a separate class that will specifically test my class of service and its methods (which generate my login / session / …) – but even then, how could I to mock user data that is needed to create my login token / session objects?)