Skip to content
RED SAGSkills
mediumQA Engineer interview question

How do you test a REST API? What do you check beyond the status code?

What the interviewer wants to hear

  • Response body schema and values
  • Headers, content type and auth
  • Negative cases: invalid input, missing auth, wrong methods
  • Data persistence and side effects
  • Performance and error handling
  • Idempotency and pagination

Model answer

I start from the API contract, such as an OpenAPI spec. For each endpoint, I check the status code, but also the response body: required fields exist, types are correct, and values match the request and the database. I validate against the schema, check headers like Content-Type, caching and CORS if needed. For auth, I test missing, expired and wrong-role tokens, and make sure one user cannot read another user's data by changing an ID. Negative tests include missing fields, wrong types, very long strings, and unsupported methods. I check side effects: after POST, the record really exists; after DELETE, it is gone. I test pagination, sorting and filters, idempotency for PUT and retries, and that error responses are consistent and do not leak stack traces. Finally I check response time. I use Postman or code-based tests so they run in CI.

Can you answer it under time pressure?

Take a timed medium round and get scored on every answer.

Start mock interview

More medium QA Engineer questions