Backend · Fresher-relevant
REST API interview questions on HTTP methods, status codes, statelessness, authentication (JWT/OAuth), and API design best practices.
What makes an API RESTful? Explain the core constraints.
Tip: REST is stateless (each request is self-contained), uses a uniform interface around resources and HTTP verbs, is cacheable, layered, and client-server separated. Resources are nouns (/orders/42), not verbs. Richardson Maturity Level 3 adds HATEOAS (hypermedia links).
When do you use PUT vs PATCH vs POST?
Tip: POST creates a resource (not idempotent). PUT fully replaces a resource at a known URI and is idempotent. PATCH applies a partial update. Idempotency matters for safe retries — repeating a PUT yields the same state, repeating a POST may create duplicates.
What do the main HTTP status code ranges mean? Give common examples.
Tip: 2xx success (200 OK, 201 Created, 204 No Content), 3xx redirection (301 permanent, 304 Not Modified), 4xx client error (400 bad request, 401 unauthenticated, 403 forbidden, 404 not found, 429 rate limited), 5xx server error (500, 503). Return 401 vs 403 correctly — they differ in auth vs permission.
How do you handle authentication and authorization in a REST API?
Tip: Authentication proves identity (who); authorization grants access (what). Common: stateless JWT or OAuth2 bearer tokens in the Authorization header, short-lived access tokens + refresh tokens, scopes/roles for authorization. Always over HTTPS; never put tokens in URLs.
How do you version a REST API and why?
Tip: Versioning prevents breaking existing clients on changes. Options: URI versioning (/v1/users — most explicit and cache-friendly), header/media-type versioning (Accept: application/vnd.api.v2+json), or query param. Add fields backward-compatibly and reserve a version bump for breaking changes.
How do you design pagination, filtering, and sorting for a list endpoint?
Tip: Offset pagination (?page=&size=) is simple but slow and inconsistent on large/changing datasets; cursor (keyset) pagination (?after=<id>) scales and is stable. Expose filtering and sorting via query params (?status=open&sort=-createdAt) and return total/next-cursor metadata.
What is idempotency and how do you make a payment/create endpoint safe to retry?
Tip: An idempotent operation produces the same result no matter how many times it runs. For non-idempotent POSTs (payments), accept a client-supplied Idempotency-Key header, store the first result keyed by it, and return that cached result on retries instead of re-executing.
How do REST and GraphQL differ, and when would you pick each?
Tip: REST exposes fixed resource endpoints and can over- or under-fetch; it has simple HTTP caching. GraphQL exposes one endpoint where clients request exactly the fields they need, reducing round-trips but complicating caching and adding query-cost concerns. Pick GraphQL for varied client data needs, REST for simple, cacheable, public APIs.
InterviewEra generates role-specific questions using your actual projects and skills. Get scored feedback on technical depth, clarity, and structure — free to start.