REST API Interview Questions

1. What is a REST API and what are the core principles of REST?

2. What does it mean for a REST API to be stateless?

3. What are the main HTTP methods and how do they map to CRUD operations?

4. What is the difference between PUT and PATCH in a REST API?

5. What is idempotency and which HTTP methods are idempotent?

6. What is the difference between safe and unsafe HTTP methods?

7. What do the major HTTP status code categories (2xx, 3xx, 4xx, 5xx) mean?

8. What is the difference between 401 Unauthorized and 403 Forbidden?

9. How should you design resource URIs and naming conventions in a REST API?

10. What is HATEOAS and what role does it play in RESTful maturity?

11. What is the Richardson Maturity Model for REST APIs?

12. How do you handle versioning in a REST API?

13. How do you implement pagination, filtering, and sorting in a REST API?

14. What is content negotiation and how does the Accept header work?

15. How do you handle errors and return meaningful error responses in a REST API?

16. What is the difference between authentication and authorization in REST APIs?

17. How does token-based authentication with JWT work in a REST API?

18. What is OAuth 2.0 and how is it used to secure REST APIs?

19. What is CORS and how do you configure it for a REST API?

20. What is rate limiting and throttling in a REST API and why are they important?

21. How do caching and the ETag / Cache-Control headers work in REST APIs?

22. What is the difference between REST and GraphQL?

23. What is the difference between REST and SOAP?

24. What is the difference between REST and gRPC?

25. How do you design a REST API for bulk or batch operations?

26. What is an idempotency key and how does it prevent duplicate requests?

27. How do you document a REST API with OpenAPI / Swagger?

28. How do you handle long-running operations in a REST API?

29. How do you test a REST API (unit, integration, contract)?

30. What are common REST API security and design best practices?

31. How do you prevent lost updates in a REST API using conditional requests?

32. Why does offset pagination degrade at scale and how does keyset pagination fix it?

33. How do you set timeouts, retries and backoff correctly when calling a REST API?

34. How do circuit breakers and bulkheads stop one slow REST dependency taking down your service?

35. How do you handle over-fetching and under-fetching in a REST API without abandoning REST?

36. How do you design reliable webhooks for a REST API, and when is polling the better choice?

37. How do you enforce tenant isolation in a multi-tenant REST API?

38. How do you design file upload and download in a REST API for large files?

39. How do you make a REST API observable enough to debug a production incident?

40. How do you keep data consistent when one REST call in a multi-service workflow fails?

41. How do you prevent mass assignment and other input-trust failures in a REST API?

42. How do you diagnose and reduce latency in a REST API at the payload and transport layer?

43. How would you design a machine-readable error format for a REST API?

44. What is the difference between JSON Patch and JSON Merge Patch, and when would you use each?

45. How do you handle two concurrent requests that arrive with the same idempotency key?

46. What should a rate-limited REST response tell the client, and how should the client react?

47. How do you deprecate and retire a REST API version without breaking consumers?

48. A browser call to your API fails with a CORS error but curl works. How do you debug it?

49. What belongs in an API gateway and what should stay in the service?

50. How do you build a reliable, secure webhook delivery system?

51. How do you cache REST API responses at a CDN without leaking data between users?

52. Why do most REST APIs stop short of HATEOAS, and when is it actually worth implementing?

53. Which REST API changes are breaking, and how do you evolve a contract without a new version?

54. How should a bulk REST endpoint report that some items succeeded and others failed?

55. How do HTTP/2 and HTTP/3 change how you design and operate a REST API?

56. How do you keep a REST service usable when demand exceeds its capacity?

57. How would you authenticate service-to-service REST calls, and when is mutual TLS worth it?

58. How should DELETE behave when your system uses soft deletes?

59. How do you expose complex search over REST when the query no longer fits in a URL?

60. How do you serve a very large export from a REST API without exhausting memory?

61. How do you model absent, null and empty values in a REST JSON contract?