When you automate tests for a REST API endpoint, what do you check?

What the interviewer wants to hear

• Status codes for success and error cases
• Response body values and schema
• Authentication and authorisation
• Validation of bad input and edge cases
• Headers, side effects and response time where relevant

Model answer

For each endpoint I check the happy path first: the exact status code, such as 201 for a create, and the important values in the body. I validate the response against the JSON schema or OpenAPI contract so missing or mistyped fields are caught. Then I cover negative cases: missing required fields and wrong types should give 400 with a clear error, no token should give 401, and a user without permission should get 403. I test boundaries like long strings, empty lists and pagination limits. I also check side effects, for example that a GET after the POST returns the new item, and key headers such as content type or caching. Where it matters I add a simple response time check, while real load testing stays in a separate suite.

More easy Automation Test Engineer questions

• Why do teams automate tests, and what should not be automated?
• Explain the Page Object Model and its benefits. Are there any downsides?
• What is the difference between implicit waits, explicit waits and auto-waiting?
• How do you run automated tests in a CI pipeline?
• When would you write an API test instead of a UI test?
• How do you choose locators for UI tests, and what makes a locator fragile?
• Explain the test pyramid. How does it guide what you automate?
• What makes an automated test good?
• Compare Selenium and Playwright. When would you choose each?