1. What is an "API" (Application Programming Interface)?

A set of rules and protocols that allows different software applications to communicate and interact with each other.

2. What is "REST" (Representational State Transfer)?

An architectural style for designing networked applications. It relies on a stateless, client-server, cacheable communications protocol (usually HTTP).

3. What are the key constraints of a "RESTful" API?

Client-Server architecture
Statelessness
Cacheability
Uniform Interface
Layered System
Code on Demand (Optional)

4. What are the common HTTP methods used in REST?

GET: Retrieve data from a server.
POST: Create a new resource on a server.
PUT: Update an existing resource (replaces the entire resource).
PATCH: Partially update a resource.
DELETE: Remove a resource from a server.

5. What's the difference between `PUT` and `PATCH`?

PUT: Replacing the entire resource with a new version.
PATCH: Updating only specific fields of a resource.

6. What is "Idempotency" in the context of REST?

An operation is idempotent if performing it multiple times has the same effect as performing it once (e.g., GET, PUT, DELETE). POST is NOT idempotent.

7. What are "Safe" HTTP methods?

Methods that don't modify the state of the resource on the server (e.g., GET, HEAD, OPTIONS).

8. What's the difference between "REST" and "SOAP"?

REST: Architectural style; uses HTTP; lightweight; supports multiple formats (JSON, XML).
SOAP: Protocol; uses XML only; heavier; highly structured with built-in security and transaction support.

9. What is "JSON" (JavaScript Object Notation)?

A lightweight data-interchange format that is easy for humans to read and write and easy for machines to parse and generate. It's the most common format for REST APIs.

10. What is a "URI" (Uniform Resource Identifier)?

A string of characters used to identify a resource (e.g., /users/123).

11. What is the difference between "URI", "URL", and "URN"?

URL: A URI that specifies the location of a resource (how to get it).
URN: A URI that specifies the name of a resource (what it is).
URI: The general term for both URLs and URNs.

12. What are "HTTP Status Codes"?

Three-digit numbers returned by a server to indicate the outcome of an HTTP request.

13. What are the main categories of HTTP Status Codes?

1xx: Informational
2xx: Success (e.g., 200 OK, 201 Created)
3xx: Redirection
4xx: Client Error (e.g., 400 Bad Request, 404 Not Found, 401 Unauthorized)
5xx: Server Error (e.g., 500 Internal Server Error)

14. What's the difference between status codes `401` and `403`?

401 Unauthorized: The user hasn't provided valid authentication.
403 Forbidden: The user is authenticated but doesn't have permission to access the resource.

15. What are "Path Parameters"?

Variables embedded directly in the URI path (e.g., /users/{id}).

16. What are "Query Parameters"?

Key-value pairs appended to the end of a URI after a ? (e.g., /search?q=query).

17. What are "Request Headers" and "Response Headers"?

Metadata sent along with the request or response, such as Content-Type, Authorization, and Cache-Control.

18. What is "Authentication" vs "Authorization"?

Authentication: Verifying WHO a user is (e.g., API keys, OAuth tokens).
Authorization: Verifying WHAT a user can do (e.g., permissions).

19. What is "Statelessness" in REST?

Each request from a client to a server must contain all the information necessary to understand and process the request. The server doesn't store any client context between requests.

20. What is "HATEOAS" (Hypermedia as the Engine of Application State)?

A constraint of the REST application architecture that distinguishes it from other network application architectures. A client interacts with a network application entirely through hypermedia (links) provided dynamically by application servers.

21. What is an "API Gateway"?

An API management tool that sits between a client and a collection of backend services, providing security, load balancing, and rate limiting.

22. What is "Rate Limiting"?

A technique used to control the amount of incoming traffic to an API by restricting the number of requests a client can make in a given period.

23. What is "Pagination" in APIs?

A technique used to divide large result sets into smaller, manageable "pages" (e.g., /users?page=1&limit=10).

24. What is "Payload" in an API request/response?

The actual data being sent in the body of the message (usually in JSON format).

25. What is "Versioning" in APIs?

A practice where different versions of an API are maintained to avoid breaking changes for existing users (e.g., /v1/users, /v2/users).

26. What is "CORS" (Cross-Origin Resource Sharing)?

A browser security feature that restricts web pages from making requests to an API hosted on a different domain unless specifically allowed by the server.

27. What is "JWT" (JSON Web Token)?

A compact, URL-safe way of representing claims that can be signed and verified, often used for secure stateless authentication in REST APIs.

28. What is "OAuth 2.0"?

An open standard for access delegation, commonly used as a way for internet users to grant websites or applications access to their information on other websites but without giving them the passwords.

29. What is "Payload Validation"?

The process of ensuring that the incoming data from a client meets the expected schema and format before processing it on the server.

30. What is the difference between "Public" and "Private" APIs?

Public: Available for use by anyone (e.g., Google Maps API).
Private: Restricted for internal use within an organization.

31. What is "Caching" in REST?

Storing a copy of an API response so that subsequent requests for the same resource can be served faster without the server having to re-process it.

32. What is the "Cache-Control" header?

Used to specify how a resource should be cached by the client and any intermediate proxies.

33. What is "ETag" (Entity Tag)?

A unique identifier for a specific version of a resource, used for web cache validation and conditional requests (e.g., If-None-Match).

34. What is "Swagger" / "OpenAPI"?

Tools and specifications for describing, producing, consuming, and visualizing RESTful web services. They help in creating interactive API documentation.

35. What is "Postman"?

A popular API platform for developers to design, build, test, and document their APIs.

36. What is "Microservices Architecture"?

A way of building a large application as a collection of small, independent services that communicate with each other via APIs.

37. What is "Payload Compression" (Gzip)?

A technique used to reduce the size of the API response body, decreasing latency and bandwidth usage.

38. What is "Webhooks"?

A way for an API to provide data to other applications in real-time. Instead of the client polling the API, the API pushes data to a specified URL when an event occurs.

39. What is the "Content-Type" header?

Used to indicate the media type of the resource (e.g., application/json, text/html).

40. What is "API Mocking"?

Creating a fake version of an API that mimics the behavior of the real API for testing purposes.

41. What is "JSONP" (JSON with Padding)?

An older technique used to bypass cross-domain restrictions in web browsers before CORS was widely supported.

42. What is the difference between "REST" and "GraphQL"?

REST: Resource-based; multiple endpoints; over-fetching/under-fetching data.
GraphQL: Query-based; single endpoint; client specifies exactly which data it needs.

43. What is "Idempotent vs. Safe" methods?

All safe methods are idempotent (e.g., GET), but not all idempotent methods are safe (e.g., DELETE, PUT).

44. What is "Request Time-out"?

Occurs when the server takes too long to process a request and the client or intermediate proxy closes the connection.

45. What is the purpose of the "OPTIONS" method?

Used by the client to find out which HTTP methods and other options are supported by the server for a specific resource.

46. What is "Rate Limit Header"?

Usually returned by the server to inform the client about their current rate limit status (e.g., X-RateLimit-Remaining).

47. What is "Self-Documenting" API?

An API that uses meaningful URIs and standard HTTP methods so that it's easy to understand without extensive documentation.

48. What is "BFF" (Backend for Frontend)?

A design pattern where a specific backend service is created for a specific frontend (e.g., mobile vs. web) to tailor the API to their unique needs.

49. What is "Payload Filtering"?

Allowing the client to specify which fields they want in the response to reduce data transfer (e.g., /users?fields=name,email).

50. Why is REST so popular?

Because it's simple, scalable, flexible, and works seamlessly with the existing infrastructure of the web (HTTP).

REST API Interview Questions

Table of Contents

What is an "API" (Application Programming Interface)?

What is "REST" (Representational State Transfer)?

What are the key constraints of a "RESTful" API?

What are the common HTTP methods used in REST?

What's the difference between <code>PUT</code> and <code>PATCH</code>?

What is "Idempotency" in the context of REST?

What are "Safe" HTTP methods?

What's the difference between "REST" and "SOAP"?

What is "JSON" (JavaScript Object Notation)?

What is a "URI" (Uniform Resource Identifier)?

What is the difference between "URI", "URL", and "URN"?

What are "HTTP Status Codes"?

What are the main categories of HTTP Status Codes?

What's the difference between status codes <code>401</code> and <code>403</code>?

What are "Path Parameters"?

What are "Query Parameters"?

What are "Request Headers" and "Response Headers"?

What is "Authentication" vs "Authorization"?

What is "Statelessness" in REST?

What is "HATEOAS" (Hypermedia as the Engine of Application State)?

What is an "API Gateway"?

What is "Rate Limiting"?

What is "Pagination" in APIs?

What is "Payload" in an API request/response?

What is "Versioning" in APIs?

What is "CORS" (Cross-Origin Resource Sharing)?

What is "JWT" (JSON Web Token)?

What is "OAuth 2.0"?

What is "Payload Validation"?

What is the difference between "Public" and "Private" APIs?

What is "Caching" in REST?

What is the "Cache-Control" header?

What is "ETag" (Entity Tag)?

What is "Swagger" / "OpenAPI"?

What is "Postman"?

What is "Microservices Architecture"?

What is "Payload Compression" (Gzip)?

What is "Webhooks"?

What is the "Content-Type" header?

What is "API Mocking"?

What is "JSONP" (JSON with Padding)?

What is the difference between "REST" and "GraphQL"?

What is "Idempotent vs. Safe" methods?

What is "Request Time-out"?

What is the purpose of the "OPTIONS" method?

What is "Rate Limit Header"?

What is "Self-Documenting" API?

What is "BFF" (Backend for Frontend)?

What is "Payload Filtering"?

Why is REST so popular?