REST API interview questions and answers

1. 401 or 403

A logged-in user with a valid token calls DELETE /admin/users/7, but they are not an admin. Which status code fits best?

1. A.401 Unauthorized
2. B.404 Not Found, always
3. C.400 Bad Request
4. D.403 Forbidden

2. Updating only one field

A client wants to change only the email of user 42 and does not want to send the other fields. Which request fits REST conventions best?

1. A.PUT /users/42 with only the email field in the body, since PUT updates whichever fields are sent
2. B.PATCH /users/42 with only the email field in the body
3. C.POST /users with the email field and id 42
4. D.GET /users/42?email=new@example.com

3. Status code for too many requests

Your API allows 100 requests per minute per key. A client sends its 101st request in the same minute. Which status code should you return?

1. A.403 Forbidden
2. B.503 Service Unavailable
3. C.429 Too Many Requests
4. D.400 Bad Request

4. What HTTPS leaves visible

A user calls your API over HTTPS on public Wi-Fi. Which of these can someone watching the network usually still see?

1. A.The JSON request body
2. B.The URL path and query string, because TLS only encrypts the body and headers of the request
3. C.The Authorization header
4. D.The server's IP address and often the hostname, via DNS and the TLS SNI field

5. Calling DELETE on a read-only route

A client sends DELETE to /reports/2026-q1, which only supports GET. What should the API return?

1. A.405 Method Not Allowed with an Allow: GET header
2. B.404 Not Found with an empty body
3. C.403 Forbidden with an Allow: GET header
4. D.400 Bad Request with a stack trace

6. A client posts XML to a JSON API

A JSON-only endpoint receives a POST with Content-Type: application/xml. Which status code should it return?

1. A.406 Not Acceptable
2. B.413 Content Too Large
3. C.415 Unsupported Media Type
4. D.422 Unprocessable Content

7. Telling the client where the new item lives

POST /invoices creates invoice 981 and returns 201. Which header should point to the new resource?

1. A.Location: /invoices/981
2. B.Content-Location: /invoices
3. C.Link: /invoices?id=981
4. D.Referer: /invoices/981

8. Route parameter never matches a number

In Express, a route /orders/:id runs this check. For a request to /orders/42 it always says not found. Why?

app.get('/orders/:id', (req, res) => {
  const order = orders.find(o => o.id === req.params.id)
  if (!order) return res.sendStatus(404)
  res.json(order)
})
// orders = [{ id: 42, ... }]

1. A.Express removes numbers from the URL path
2. B.req.params.id is the string '42', not the number 42
3. C.The route must be written as /orders/{id}
4. D.find only works on arrays of strings

9. Response for a queued report job

POST /exports starts a large export that takes several minutes in the background. What should the API return straight away?

1. A.202 Accepted with a link to check the job status
2. B.200 OK after waiting for the export to finish
3. C.201 Created with the finished file
4. D.204 No Content and nothing else

10. How many URLs a GraphQL API uses

A team moves from REST to GraphQL. How are different queries and mutations usually sent to the server?

1. A.To one URL per type, like /graphql/users
2. B.To one endpoint such as POST /graphql
3. C.To one URL per field the client needs
4. D.Over FTP, since GraphQL is not HTTP

11. Stack traces in production errors

A 500 response in production includes the full stack trace, file paths and SQL text. What should it return instead?

1. A.The same stack trace, but base64-encoded
2. B.An empty 200 response so clients do not panic
3. C.A generic message plus an error id to find the logs
4. D.The stack trace only for requests from mobile apps

12. Telling users about a long job

A report export takes 3 minutes and runs as a background job. What should the API return when the user requests it?

1. A.200 OK after waiting for the job to finish
2. B.204 No Content and nothing else
3. C.500 if the job is not done within 30 seconds
4. D.202 Accepted with a job ID to check status

13. Which method is idempotent

Which HTTP method is defined as idempotent, meaning sending the same request twice has the same effect on the server as sending it once?

1. A.PUT
2. B.POST
3. C.Any method, as long as it returns JSON
4. D.Only methods sent over HTTPS

14. PATCH vs PUT for one field

On a settings page the user changes only their display name. The client wants to send just that one field. Which request fits REST conventions best?

1. A.PUT /api/users/42 with { "name": "Asha" }
2. B.PATCH /api/users/42 with { "name": "Asha" }
3. C.GET /api/users/42?name=Asha
4. D.POST /api/users/42/name/Asha

15. URL for a user’s orders

Which endpoint best follows REST conventions for listing the orders of user 42?

1. A.GET /getUserOrders?userId=42
2. B.POST /users/42/orders
3. C.GET /orders/list/users/42
4. D.GET /users/42/orders

16. What triggers a preflight

Your frontend at app.example.com calls api.example.com. Which request makes the browser send an OPTIONS preflight first?

1. A.A GET with no custom headers
2. B.A POST with an application/x-www-form-urlencoded body
3. C.A request to the same origin
4. D.A POST with Content-Type: application/json

17. Dates sent through JSON

An API returns this object as JSON and the client parses it. What does the last line print?

const sent = { createdAt: new Date('2026-01-05T10:00:00Z') }
const received = JSON.parse(JSON.stringify(sent))
console.log(typeof received.createdAt)

1. A.string
2. B.object
3. C.number
4. D.undefined

18. Permanent vs temporary redirect

You have moved your blog permanently from /blog to a new domain. Which HTTP status should the old URLs return?

1. A.302 Found
2. B.304 Not Modified
3. C.301 Moved Permanently
4. D.307 Temporary Redirect

19. Idempotent requests

Which operation is idempotent, so it is safe to retry after a timeout?

1. A.POST /orders that creates a new order each time
2. B.PUT /users/42/email setting the email to a fixed value
3. C.POST /payments that charges a card
4. D.A call that adds 10 to an account balance

20. Turning on text compression

A JSON API returns 800 KB responses as plain text. What does enabling gzip or Brotli compression mainly improve?

1. A.The database runs its queries faster
2. B.The server needs no memory for requests
3. C.Less data is sent, so transfer time and bandwidth drop
4. D.The number of users allowed doubles automatically

21. Token bucket rate limiter

You rate-limit an API with a token bucket: capacity 10 tokens, refilled at 1 token per second. A client has been idle for a minute and then sends 15 requests at once. What happens?

1. A.About 10 requests are allowed immediately and the rest are rejected until tokens refill
2. B.All 15 are allowed because the client was idle for 60 seconds
3. C.Only 1 request is allowed per second, so 14 are rejected
4. D.All 15 are rejected because the burst is larger than the capacity

22. CDN serves one user's profile to another

After putting a CDN in front of your API, user B sometimes receives user A's data from GET /me. Which response header change fixes this?

1. A.Send Cache-Control: private (or no-store) on per-user responses so shared caches do not store them
2. B.Send Cache-Control: public, max-age=3600
3. C.Add an ETag header so the CDN revalidates every response with the origin before serving it to any user
4. D.Switch the CDN to HTTP/3

23. 400 versus 422

Many APIs use both 400 and 422 for bad input. Which split between them is the common convention?

1. A.400 for missing auth, 422 for missing permissions
2. B.400 for bad GET requests, 422 for bad POST requests
3. C.400 for malformed syntax, 422 for well-formed invalid values
4. D.400 for server-side bugs, 422 for database write errors

24. Redirecting a POST endpoint

POST /v1/payments has moved permanently to /v2/payments. Some clients follow the redirect but send a GET with no body. Which status code keeps the method and body?

1. A.301 Moved Permanently
2. B.302 Found
3. C.303 See Other
4. D.308 Permanent Redirect

25. no-cache or no-store for account data

A bank balance response must never be written to disk by browsers or proxies. Which header does that?

1. A.Cache-Control: no-cache
2. B.Cache-Control: max-age=0
3. C.Cache-Control: no-store
4. D.Cache-Control: must-revalidate

26. Arabic page served to English users

An API returns English or Arabic text based on the Accept-Language header. After adding a CDN, some English users get Arabic. What header is missing?

1. A.Content-Language: en
2. B.Vary: Accept-Language
3. C.Accept-Ranges: bytes
4. D.Cache-Control: public

27. Telling clients when to retry

Your API returns 429 Too Many Requests. Which response header tells the client how long to wait?

1. A.Retry-After
2. B.Expires
3. C.Keep-Alive
4. D.Age

28. Webhooks retried though they worked

Your webhook handler sends emails and generates a PDF before replying, taking 25 seconds. The provider marks deliveries as failed and retries. What should you change?

1. A.Raise your own server timeout to 60 seconds
2. B.Save the event, reply 2xx, do the work in a queue
3. C.Reply 202 only once the PDF has been made
4. D.Block the provider's retries in your firewall

29. Paging through a GraphQL list

In the common GraphQL 'connection' pagination style, how does a client ask for the next page of orders?

query {
  orders(first: 20, after: "Y3Vyc29yOjQw") {
    edges { node { id total } cursor }
    pageInfo { hasNextPage endCursor }
  }
}

1. A.Pass the last page's pageInfo.endCursor as after
2. B.Increase first to 40 and drop the duplicates
3. C.Pass the page number in the cursor field
4. D.Call a separate nextPage mutation

30. Printing each message at most once per 10 seconds

A logger should print a message only if the same message was not printed in the last 10 seconds. What does the map store?

1. A.Message to the timestamp it was last printed
2. B.Timestamp to the list of messages
3. C.Message to the number of times it was seen
4. D.A Set of all messages ever printed

31. One bad item in a batch call

A bulk API accepts 500 contacts. One has an invalid email. Currently the whole batch returns 400 and the client retries all 500 forever. What is a better design?

1. A.Process valid items and return a per-item result list
2. B.Return 200 and silently skip the invalid contact
3. C.Reject the batch and ask clients to send one at a time
4. D.Return 500 so the client knows to retry later

32. Offset vs cursor pagination

An infinite-scroll feed uses LIMIT 20 OFFSET n. New posts are added every few seconds and users report seeing duplicate posts. What is the better design?

1. A.Cursor (keyset) pagination: return items WHERE created_at, id are older than the last item seen
2. B.Increase the page size to 200
3. C.Use OFFSET but sort randomly
4. D.Load the entire table once and paginate in the browser

33. Users see each other’s profile

GET /api/me returns the logged-in user’s profile with Cache-Control: public, max-age=300. After putting a CDN in front, some users see someone else’s name. What is the fix?

1. A.Lower max-age to 30 seconds
2. B.Add a random query string on the client
3. C.Move the endpoint to a separate subdomain so the CDN keeps a separate cache per user
4. D.Send Cache-Control: private (or no-store) for personalized responses

34. GraphQL author lookups

A GraphQL query asks for 50 posts with { author { name } }. Logs show 51 SQL queries. What is the standard fix?

1. A.Switch the API from GraphQL to REST
2. B.Cache every author forever in Redis so the resolver never has to touch the database
3. C.Limit the query to 10 posts
4. D.Use a per-request DataLoader so author lookups are batched into one query

35. Rate limit keyed on X-Forwarded-For

Your login rate limiter reads the client IP from the first X-Forwarded-For value. Attackers bypass it easily. Why?

1. A.X-Forwarded-For is always empty over HTTPS
2. B.Rate limits only work with IPv6
3. C.Browsers rotate IPs on every request
4. D.Clients can put any value in that header

36. Many login attempts in one request

Your login rate limit counts HTTP requests. An attacker sends one GraphQL request with 500 aliased login mutations. What happened?

1. A.GraphQL ignores aliases
2. B.The server ran only the first mutation
3. C.TLS rejected the large request
4. D.Aliases bypassed a per-request rate limit

37. Every request comes from the load balancer

Behind an HTTP load balancer, your app logs show every request coming from 10.0.x.x addresses. How do you get the real client IP?

1. A.Read X-Forwarded-For set by the load balancer
2. B.Read the TCP source address more carefully
3. C.Ask the client to send its IP in the body
4. D.Disable TLS on the load balancer

38. Serving stale while refreshing

A response has "Cache-Control: max-age=60, stale-while-revalidate=300". What happens at 2 minutes old?

1. A.The cache blocks the user until origin replies
2. B.The object is deleted and returns 404
3. C.The cache serves it only to logged-in users
4. D.The stale copy is served while a background refresh runs

39. New connection for every request

A script sets k6 option noConnectionReuse: true. Latency rises and server CPU goes up. Why?

1. A.k6 stops sending HTTP headers
2. B.The server starts compressing every response twice
3. C.Connection reuse only affects DNS
4. D.Each request pays for a new TCP and TLS handshake

40. The strongest signal of demand

After a demo, four prospects react differently. Whose reaction is the strongest evidence of real demand?

1. A.A dentist says "This is amazing, I'd definitely use it"
2. B.A clinic owner pays ₹15,000 upfront for a three-month pilot
3. C.A hospital manager asks you to email the brochure
4. D.A doctor likes your LinkedIn post about it

41. Safe retries for payments

A mobile app calls POST /payments. The network times out, so the app retries, and the customer is charged twice. What is the most robust fix?

1. A.Client sends a unique Idempotency-Key; the server stores it with the result under a unique constraint and returns the saved result for repeats
2. B.Disable retries in the mobile app completely
3. C.Change the endpoint from POST to GET so it becomes idempotent
4. D.Check if a payment with the same amount was made in the last 10 seconds and skip it

42. Retries at every layer

A mobile app, the gateway and the order service each retry a failed call up to 3 attempts in total. When the payment service is down, how many calls can one tap cause at the payment service?

1. A.27
2. B.9
3. C.3
4. D.6

43. Users uploading 2 GB videos

Users upload videos up to 2 GB, and routing them through your API servers ties up memory and bandwidth. What is the standard design?

1. A.Raise the JSON body size limit to 2 GB
2. B.Let clients upload to storage with a presigned URL
3. C.Base64-encode each video inside a JSON field
4. D.Have users email their large files to support

44. Rate limiter blocks everyone together

Behind a load balancer, an Express rate limiter keyed on req.ip starts blocking all users at once. What is the likely cause?

1. A.req.ip is the load balancer's IP; set 'trust proxy' correctly
2. B.The limiter counts requests per URL, not per IP
3. C.Express caches req.ip for every user
4. D.Load balancers strip all headers from requests

45. Every page load counts 80 million rows

GET /events?limit=50 also returns total, computed with COUNT(*) on an 80-million-row table, and it is the slowest part of the request. What is a common API design change?

1. A.Cache the count in the browser forever
2. B.Count only the rows on the current page
3. C.Return has_more or a next cursor instead of an exact total
4. D.Return the total in a response header instead

46. Search filters too long for a URL

A search endpoint takes dozens of filters, nested conditions and a list of up to 500 SKUs. Long GET URLs fail at some proxies. What is a reasonable design?

1. A.Split the SKU list across many GET requests
2. B.POST /products/search with the filters in a JSON body
3. C.Send the filters in a custom request header
4. D.Use GET with a body, since HTTP allows it

47. A PUT wipes the phone number

A client sends PUT /customers/7 with only {"email": "new@example.ae"}. The server follows PUT semantics strictly. What happens to the customer's phone number?

1. A.It is kept, because PUT only changes sent fields
2. B.It is cleared, because PUT replaces the whole resource
3. C.It is copied into the email field
4. D.The server must reject PUT bodies with one field

48. Locking accounts after 5 failures

Accounts are locked for 24 hours after 5 wrong passwords. Attackers start locking out real users on purpose. What is a better approach?

1. A.Lock accounts for good after 3 failures
2. B.Remove every limit on login attempts
3. C.Growing delays and risk checks, not hard locks
4. D.Let anyone unlock by typing the email

49. Preventing double charges on retry

The checkout page sends POST /api/payments. The request times out on a slow network, the client retries, and the customer is charged twice. What is the most robust fix?

1. A.Disable the Pay button for 2 seconds after a click
2. B.Increase the server timeout to 60 seconds
3. C.Send a client-generated idempotency key; the server stores it with a unique constraint and returns the saved result for any repeat with the same key
4. D.Change the endpoint from POST to GET

50. Large IDs change in the browser

The database uses BIGINT ids, and the API serializes them as JSON numbers. What does the client print here?

const body = '{"id": 9007199254740993}'
console.log(JSON.parse(body).id)

1. A.9007199254740993
2. B.9007199254740992
3. C.An exception: number too large
4. D.9007199254740993n

51. Items missing between pages

An activity feed uses this cursor query. After a bulk import gave 300 rows the same created_at, users report items missing between pages. What is the fix?

SELECT * FROM events
WHERE created_at < $1  -- created_at of last row on previous page
ORDER BY created_at DESC
LIMIT 50;

1. A.Switch to OFFSET pagination for imported data
2. B.Use <= instead of < in the WHERE clause
3. C.Order by (created_at, id) and use both as the cursor: WHERE (created_at, id) < ($1, $2) ORDER BY created_at DESC, id DESC
4. D.Increase LIMIT to 500 so ties fit on one page

52. Choosing an API contract approach

Your API will be used by the Next.js web app, native iOS and Android apps and outside partners. The team wants end-to-end type safety. Which approach fits best?

1. A.An OpenAPI contract with generated typed clients for each platform
2. B.tRPC only, because it gives every client full end-to-end types without writing any schema
3. C.Share the TypeScript types folder with partners by email
4. D.Skip a contract and document endpoints in a README

53. Duplicate orders from offline retries

An offline queue retries a "place order" POST after a timeout. The server had actually processed the first attempt, so the customer gets two orders. What is the right fix?

1. A.Retry less often, waiting at least ten minutes between attempts, so the server has time to finish and its own duplicate check can catch up
2. B.Create an idempotency key on the device, keep it with the queued request and send it on every retry, so the server returns the first result
3. C.Send the order as a GET request
4. D.Delete the request from the queue after the first attempt, whatever the outcome

54. Renaming a field in the API

The backend team wants to rename `price` to `amount` in the orders API this week. Why must mobile apps be considered differently from the web app?

1. A.Mobile apps download the API schema daily from the stores
2. B.Old app versions stay installed for months and still expect price
3. C.Mobile apps cannot parse JSON fields named amount
4. D.Mobile releases always ship on the same day as the backend

55. HTTP/3 on a network that blocks UDP

A corporate firewall blocks outbound UDP 443. What happens when a browser tries a site that supports HTTP/3?

1. A.The site fails to load at all
2. B.The browser tunnels QUIC inside DNS
3. C.It falls back to HTTP/2 or HTTP/1.1 over TCP
4. D.It switches to plain HTTP on port 80

56. Static pages never cached

Your marketing pages have long Cache-Control headers, yet the CDN reports 0% hits. Every response includes a Set-Cookie for an analytics session. What is the likely cause?

1. A.CDNs never cache HTML pages
2. B.Cache-Control is ignored over HTTPS
3. C.Many CDNs skip caching responses that set cookies
4. D.Analytics cookies make pages too large to cache

57. HTTP/3 on lossy mobile networks

Your app's users on congested mobile networks see long stalls with HTTP/2. Why might HTTP/3 help most in this case?

1. A.QUIC recovers loss per stream, avoiding TCP blocking
2. B.HTTP/3 compresses images better than HTTP/2
3. C.HTTP/3 needs no encryption, so it is faster
4. D.HTTP/3 uses larger packets to beat congestion

58. The gateway throttles the test

The API gateway allows 100 rps per client IP. Your test sends 1,000 rps from one load generator IP and gets mostly 429s. The goal is to test the services behind the gateway. What should you do?

1. A.Agree a test exemption or spread load like real clients
2. B.Report that the services can only handle 100 rps
3. C.Remove all error checks from the script
4. D.Retry every 429 immediately until it succeeds

59. Infinite scroll category pages

A category page loads more products by infinite scroll with no change in URL. Products beyond the first 24 never get indexed. What is the fix?

1. A.Increase the scroll speed so Googlebot sees more
2. B.Put all 2,000 products into the very first page load
3. C.Give each chunk its own URL, linked with <a href>
4. D.Add the products only to the meta description

60. A concierge MVP that customers love

You validated demand by manually doing the work for 10 customers (a concierge MVP). They love it. What must you test before scaling?

1. A.Whether customers like your team personally
2. B.Whether 10 customers is enough for an IPO
3. C.Whether software can deliver the value at viable cost
4. D.Nothing; love proves the business works