Interview Prep Guide

REST API Interview Questions and Answers for Freshers to Experienced Developers

Prepare for REST API interviews with questions on HTTP methods, status codes, versioning, idempotency, security, and API design trade-offs.

Basic REST API Interview Questions

What is REST and how is it different from just sending JSON over HTTP?
REST is an architectural style that uses resource-oriented design, standard HTTP semantics, and predictable interfaces rather than arbitrary endpoint behavior.
What is the difference between GET, POST, PUT, PATCH, and DELETE?
GET reads data, POST creates, PUT replaces, PATCH partially updates, and DELETE removes a resource.
How should REST endpoints usually be named?
Endpoints are usually resource-oriented and noun-based, with consistent plural naming and predictable nesting only where it adds real clarity.

What do idempotency and status-code discipline mean in API design?
Idempotency means repeated identical requests have the same effect, and status-code discipline means returning responses that clearly reflect success, failure, and client/server responsibility.
What is the difference between authentication and authorization in an API?
Authentication verifies who the caller is, while authorization determines what that caller is allowed to do.
How would you support pagination, filtering, and sorting in a REST API?
Use clear query parameters, stable ordering, documented limits, and responses that make pagination state easy for clients to understand.

How would you think about versioning, security, and backward compatibility in a public API?
Versioning should be deliberate, security should be built into auth and access design, and backward compatibility should protect consumers from breaking changes unless migration is clearly managed.
How do you think about API versioning?
Versioning helps you evolve contracts safely, but you should still aim to make changes thoughtfully and avoid unnecessary breaking changes.
How would you protect a public REST API from abuse or overload?
Use layered protections like rate limiting, validation, auth, quotas, and monitoring so bad traffic cannot easily exhaust your system.

How would you redesign a REST API that became hard to maintain because each team added custom endpoints and inconsistent response shapes?
Re-center the API around predictable resources, shared conventions, and consumer-friendly contracts before adding more endpoints.

What makes an HTTP method idempotent?
A method is idempotent when repeating the same request has the same intended server-side effect as sending it once.
How should an API model errors?
Use the correct status category and a stable machine-readable body containing a code, safe message, field details where relevant, and a trace identifier.
How does HTTP caching reduce API load safely?
Define who may cache the response, how long it is fresh, how it is validated, and which request properties change the representation.
What does CORS protect and what does it not protect?
CORS controls whether browser scripts may read cross-origin responses; it is not authentication, authorization, CSRF protection, or a restriction on non-browser clients.
How do you evolve a public API without breaking clients?
Prefer additive changes, tolerant readers, stable defaults, explicit deprecation, usage telemetry, and a migration window before removing behavior.

Design the endpoints and payloads for a task or order service
Strong candidates start with resources and use cases before jumping into endpoint names. A good answer explains how requests, validation, responses, and failure cases work together for real clients.
Design and implement a CRUD-style resource API with pagination, validation, and consistent error handling
Interviewers usually look for predictability more than cleverness. Strong answers explain how clients discover failure states, how invalid input is reported, and why the resource contract stays consistent across create, read, update, and list flows.