How would you approach API testing, and what tools do you use to validate response codes and payloads?