How would you design an API that lets users upload large files, such as videos of several gigabytes?

What the interviewer wants to hear

• Upload directly to object storage with presigned URLs
• Multipart or resumable uploads for large files
• Validate size, type and permissions; scan for malware
• Track upload state in the database and confirm completion
• Process asynchronously, for example transcoding via a queue

Model answer

I would not stream gigabytes through the API servers. Instead, the client asks the API to start an upload; the API checks permissions and limits, creates a record with status "pending" in the database, and returns presigned URLs for object storage such as S3. For big files I use multipart upload, so the client sends parts in parallel and can resume after a network failure by retrying only the missing parts. When all parts are done, the client calls a complete endpoint, or a storage event notifies us, and the API verifies size and content type. Then a job goes onto a queue for malware scanning and processing like transcoding or thumbnails, and the status changes to "ready". Files are served through a CDN with signed URLs if they are private. This keeps API servers light and lets storage handle the heavy traffic.

More medium Backend Developer questions

• An API endpoint is slow because it runs a heavy database query. How would you add caching, and how do you keep the cache correct?
• You need to rename a column in a large production table that the live app uses. How do you do it without downtime?
• How do you change a public API without breaking existing clients, such as old mobile app versions?
• Users say one API endpoint has become slow in production. How do you find and fix the cause?
• Sending emails and generating PDF invoices makes your checkout API slow. How would you move this work to the background?
• How would you add rate limiting to a public API that runs on many servers?
• You are asked to review the security of a REST API before launch. What would you check?
• Your service receives webhooks from a payment provider. How do you make handling them secure and reliable?
• When would you choose Kafka and when RabbitMQ for messaging between services?