API Testing Interview Questions

API tests run faster and don't break simply because a button's color or layout genuinely changed, since they're checking the actual underlying data and logic, not the visible screen at all. They also let you test a backend's own actual behavior even before a frontend has genuinely been built to actually consume it yet.

An API (Application Programming Interface) is a defined way for one piece of software to actually request data or a specific action from another. A weather app calling a weather service's API to actually fetch today's forecast is a genuinely everyday example most people interact with constantly without ever noticing it directly.

REST APIs, using standard HTTP methods and typically returning JSON, are by far the most common today. SOAP APIs use a more rigid, XML-based protocol, often still found in older, established enterprise systems. GraphQL APIs let a client actually specify exactly what data it wants in a single request, rather than being limited to a fixed, predefined response shape.

A request is what the client actually sends to the API, specifying the endpoint, the HTTP method, and any data or parameters being sent along. A response is what the API actually sends back, including a status code, headers, and typically a body containing the actual requested data or a genuine result of the requested action.

APIs often contain the real, core business logic of an application, and a bug there can genuinely affect every single client consuming that API, beyond just one specific screen in one specific app. Testing at the API layer directly also tends to be faster and more stable than testing everything solely through the UI, making it a genuinely efficient place to catch a real issue early.

GET retrieves data without genuinely changing anything on the server. POST creates a new resource. PUT updates an existing resource, typically replacing it entirely. PATCH updates a resource partially. DELETE removes a resource.

PUT is meant to replace a resource entirely, so the request body should genuinely contain the complete updated representation of it. PATCH is meant for a partial update, changing only the specific fields actually included in the request, leaving everything else genuinely untouched.

2xx codes indicate success. 3xx codes indicate redirection. 4xx codes indicate a genuine client error, something wrong with the actual request itself. 5xx codes indicate a genuine server error, something that went wrong on the actual server's own side while processing an otherwise valid request.

401 Unauthorized means the caller genuinely isn't authenticated at all, or provided genuinely invalid credentials. 403 Forbidden means the caller is genuinely authenticated, but simply doesn't have permission to actually access that specific resource or perform that particular action.

429 Too Many Requests means the caller has exceeded a defined rate limit. A well-designed API typically includes a Retry-After header alongside it, telling the client exactly how long to actually wait before genuinely trying the request again, rather than leaving the client to simply guess at an appropriate retry delay on its own.

Headers carry additional metadata about a request or a response, separate from the actual body itself. Content-Type tells the receiver what format the body is actually in, like application/json. Authorization commonly carries a token or credentials genuinely needed to actually access a protected endpoint.

A path parameter is embedded directly within the actual URL path itself, like the 123 in /users/123, typically identifying a specific resource. A query parameter appears after a question mark, like ?page=2, typically used to filter, sort, or otherwise modify what's actually returned by a given request.

REST (Representational State Transfer) is an architectural style for building APIs around resources, each identified by its own specific URL, manipulated using standard HTTP methods. Core principles include being stateless (the server doesn't genuinely remember anything about a client between separate requests), and having a genuinely uniform, consistent interface across every resource.

Each individual request must actually contain everything the server genuinely needs to process it, with the server itself keeping absolutely no memory of any previous request from that same specific client. This means every single request needs to carry its own complete, actual authentication information, rather than relying on the server having remembered a login from some earlier, previous request.

JSON (JavaScript Object Notation) is a lightweight, genuinely human-readable format for representing structured data, using key-value pairs and nested arrays or objects. It's commonly used because it's simple to actually parse in essentially any programming language and is noticeably less verbose than an older alternative like XML.

An endpoint is a specific URL representing a particular resource or a specific action an API actually exposes, like /users or /users/123/orders. Each individual endpoint typically supports one or more of the standard HTTP methods, each doing something genuinely different against that same underlying resource.

Versioning lets an API introduce a genuinely breaking change without immediately breaking every single existing client still depending on the older version, commonly done through the URL itself, like /api/v1/users versus /api/v2/users. It's needed because multiple different clients likely depend on that same API, and they can't realistically all be updated to a new contract at the exact same instant.

HATEOAS (Hypermedia as the Engine of Application State) means a response includes links describing what actions a client can genuinely take next, rather than the client needing to already know every possible endpoint URL in advance. Few real-world APIs actually implement it fully, but it's often cited as the more theoretically complete, mature end of REST's own actual maturity model.

An idempotent operation produces the exact same actual result no matter how many times it's genuinely repeated. GET, PUT, and DELETE are all expected to be idempotent. POST genuinely isn't, since calling it twice typically creates two genuinely separate resources rather than just one.

Postman is a widely used tool for manually testing an API directly, letting you construct a request, actually send it, and directly inspect the response, without needing to write any actual code at all. It's commonly used for exploratory API testing, quick debugging, and documenting exactly how an API's endpoints are genuinely meant to actually be used.

Select GET as the method, enter the actual endpoint URL, and click Send. Postman then displays the actual response, including its status code, response time, headers, and body, directly within the same application window.

A Collection groups related API requests together, letting you organize, actually share, and run them together as one genuinely coherent set, rather than each individual request existing as a genuinely isolated, unrelated item on its own. It's commonly organized to mirror an actual API's own real structure, one folder per genuinely distinct resource, for instance.

In the Body tab, select raw and choose JSON as the format, then type the actual JSON payload directly into the text area provided. Postman automatically sets the appropriate Content-Type header for you once you've genuinely selected that specific format.

An environment stores a set of variables, like a base URL or an API key, specific to one particular context, like development versus production. Switching between environments lets the exact same collection of requests actually run against a genuinely different environment without manually editing every single individual request by hand each time.

Postman displays the actual returned status code directly at the top of the response panel immediately after a request is sent, letting you visually confirm it matches what you actually expected, without needing any explicit automated assertion at all for a quick, manual, one-off check.

The request body carries the actual data being sent to the server, typically required for POST, PUT, and PATCH requests where you're actually creating or modifying something. A GET request typically doesn't genuinely need a body at all, since it's only actually retrieving existing data rather than sending any new data.

Compare the actual returned JSON's specific fields and values against what you genuinely expected, either by visually inspecting it manually, or, in an automated test, using an actual assertion checking a specific field's value directly, like confirming response.body.name equals the exact expected name.

Response time measures how long the actual API genuinely took to respond. Even a functionally correct response that takes an unreasonably long time to actually arrive represents a genuinely poor real experience for whatever's actually consuming that API, which is exactly why response time is commonly checked alongside pure functional correctness.

A mock server simulates an actual API's responses without a genuinely real backend actually running behind it. It's used when the real API genuinely isn't ready yet, or when you specifically need to test how your own code handles a particular response, like a genuine error, that's genuinely hard to reliably trigger against the real, actual live API on demand.

A stub returns a fixed, predetermined response regardless of what it's actually called with, used mainly to let a dependent test genuinely run at all. A mock additionally verifies that it was actually called correctly, with the right arguments and the right number of times, making it useful for confirming an actual interaction genuinely happened as expected, beyond simply confirming a fallback response was available.

Happy path testing confirms the API genuinely behaves correctly when given valid, expected input. Error testing confirms it responds appropriately, with the correct status code and a genuinely clear, useful error message, when given invalid input or when some other actual failure condition genuinely occurs, rather than the API simply crashing or returning something entirely unhelpful.

Check that the actual response includes the expected headers with the actually correct values, like confirming Content-Type is genuinely set to application/json when a JSON body is actually expected. In Postman, this can be checked visually in the Headers tab of the actual response, or with an explicit assertion in an automated test.

The actual status code matches what's genuinely expected. The response body's actual structure and specific values genuinely match what's expected. Response time falls within a genuinely acceptable range. And relevant headers are actually present and genuinely correct where that specifically matters.

Send a request with intentionally invalid data, like a missing required field or a genuinely malformed email address, and confirm the API returns an appropriate 4xx status code along with a genuinely clear, useful error message, rather than either silently accepting the bad data outright, or returning a confusing, unhelpful 500 server error instead.

Schema validation checks that a response's actual structure, its field names, and each field's actual data type, genuinely matches a predefined, expected schema, rather than just checking a few specific individual field values by hand. It's useful because it catches a genuinely broader class of structural issue at once, an unexpected field genuinely missing, or a field's actual type quietly changing, without needing to write a genuinely separate, individual assertion for every single field.

Confirm that a request genuinely without valid credentials is actually rejected, typically with a 401 status code, and that a request with genuinely valid credentials is correctly accepted and processed as expected. I'd also check that an expired or a genuinely invalid token is specifically and correctly rejected too, beyond just a completely missing one.

Testing only valid input confirms the API genuinely works correctly under ideal, expected conditions, but real-world usage genuinely, inevitably includes malformed requests, missing fields, and unexpected data. Testing with deliberately invalid data confirms the API fails gracefully and predictably, rather than crashing outright or, worse, silently processing genuinely bad, invalid data as if it were perfectly valid.

Verify the actual authorization flow itself correctly issues a valid token, then confirm that token genuinely works when actually included on a protected endpoint's request. I'd also test an expired token, a genuinely revoked token, and a token that's actually missing a required scope, confirming each one is correctly and appropriately rejected in its own distinct, specific way.

A JWT is a self-contained, digitally signed token carrying identity claims directly within it. I'd verify the API genuinely rejects a token with an actually invalid signature, a genuinely expired token, and a token that's simply been tampered with, in addition to confirming a genuinely valid, correctly signed token is properly accepted as expected.

Test the exact same specific endpoint using accounts with genuinely different roles, confirming each role can only actually access what it's genuinely supposed to be permitted to access. A regular user attempting to actually access an admin-only endpoint should genuinely receive a 403 Forbidden, not simply be allowed through unexpectedly.

Confirm that a genuinely valid refresh token correctly issues a new, valid access token, and that an expired or an already-used refresh token is correctly and appropriately rejected. I'd also verify the actual old access token genuinely stops working once appropriately replaced, if the API's own specific design actually calls for that particular behavior.

Variables let you actually store and reuse a value, like a base URL or a token, across multiple different requests rather than genuinely hardcoding it repeatedly everywhere. A global variable is genuinely accessible across every single collection. An environment variable is scoped specifically to just one particular environment, letting the exact same request genuinely behave differently depending on which environment is currently actually active.

A pre-request script runs actual JavaScript code before a request is genuinely sent, commonly used to dynamically generate a timestamp, compute an actual authentication signature, or fetch and set a genuinely fresh token before the actual main request itself is genuinely sent out.

In the Tests tab, JavaScript code using Postman's own built-in pm library writes actual assertions, like pm.test('Status is 200', () => pm.response.to.have.status(200));, which runs automatically right after the request completes and reports a clear, actual pass or fail directly within Postman itself.

Collection Runner executes every single request in a Collection sequentially, one after another, running any actual test scripts attached and reporting the aggregated results together. It solves the genuine problem of needing to manually and repeatedly click Send on each individual request one at a time to actually check them all.

Extract the needed value from the first request's actual response inside its own Tests script, and store it in an environment variable using pm.environment.set(). The very next request can then genuinely reference that same stored variable directly in its own URL, headers, or body.

REST Assured is a Java library specifically for testing REST APIs, letting you write actual automated tests in a genuinely readable, fluent style, directly sending a request and asserting on the actual response, all within genuine, real code rather than a manual GUI tool.

given().when().get('/users').then().statusCode(200); sends an actual GET request to the /users endpoint and asserts the returned status code genuinely equals 200, all expressed in one single, fluent, readable line of actual code.

Automated tests can run repeatedly and consistently, as part of an actual CI pipeline, on every single build, catching a genuine regression immediately rather than depending entirely on someone manually remembering to actually re-test that same specific thing by hand every single time. It also scales dramatically better once an API has genuinely grown to have dozens or hundreds of endpoints that genuinely all need to be checked regularly.

Postman's scripts work well for quicker, more exploratory or lightweight automation directly alongside genuinely manual testing. A dedicated automation framework in a real programming language integrates more naturally into a genuine CI/CD pipeline, and generally gives you far more flexibility for complex genuine test logic, data-driven testing, and detailed, structured reporting.

Organize tests by resource or by actual feature area, extract genuinely common, repeated logic like authentication setup into shared, reusable helper functions, and keep actual test data genuinely separate from the test logic itself, rather than hardcoding specific values directly and repeatedly inside every single individual test.

SOAP uses a genuinely rigid, XML-based message format with a strict, formally-defined contract (WSDL), and typically only actually uses HTTP POST regardless of the actual underlying operation being performed. REST is genuinely more flexible, using different HTTP methods meaningfully and typically returning JSON, which is generally simpler and faster to actually test than SOAP's own more rigid, verbose XML structure.

WSDL (Web Services Description Language) is an actual XML document formally describing a SOAP service's own available operations, their genuine parameters, and the exact expected message format. Testers reference it directly to understand precisely how to genuinely construct a correct, valid request against that specific service.

GraphQL exposes a genuinely single endpoint where a client specifies exactly what actual data it wants in the request itself, rather than a REST API's fixed, separate endpoint per resource with a genuinely predetermined response shape. Testing GraphQL involves verifying that different, varying queries return exactly the actual specific data genuinely requested, and that requesting a genuinely non-existent field is handled correctly and gracefully with an appropriate error.

Since GraphQL commonly returns 200 regardless of whether the actual query genuinely succeeded, I'd check the response body's own dedicated errors field directly, rather than relying purely on the HTTP status code alone, which unlike a typical REST API often doesn't genuinely reflect whether the actual query itself succeeded or failed.

Data-driven testing runs the exact same test logic repeatedly, using different sets of actual input data each time, commonly pulled from an external file or a data structure defined directly in code. It avoids writing a genuinely near-identical, separate test for every single different combination of input you actually need to verify.

A missing required field. A field containing the genuinely wrong data type, like text where a number is actually expected. A value falling well outside any actual defined valid range. An extremely long string potentially exceeding an actual defined length limit. Special characters or genuinely malicious input intentionally designed to probe for something like an injection vulnerability.

Send a request body that's deliberately not genuinely valid JSON at all, like JSON with a missing closing brace, and confirm the API returns a clear, appropriate 400 Bad Request rather than crashing outright, or worse, returning a genuinely confusing 500 server error instead.

Test the actual boundary values themselves specifically, 1, 100, and also 0 and 101, since bugs disproportionately tend to occur right at those specific edges rather than comfortably somewhere well within the middle of a genuinely valid range.

Extract the specific value directly from the first response using its own actual JSON path, store it in a variable, and pass that same stored variable directly into the following request. This lets a full genuine test flow, create, then read, then update, then delete, run correctly against real data generated genuinely fresh during that same specific test run.

Define a JSON schema describing the actual expected response structure, and use a schema validation library, or REST Assured's own built-in matchesJsonSchemaInClasspath() capability, to genuinely assert the actual response conforms to that predefined schema, catching a genuinely broader class of structural issue at once rather than checking individual fields one at a time by hand.

Chain the actual operations together in a genuinely logical sequence within a single coherent test, or a clearly related, connected group of tests: create a resource and capture its actual returned ID, read it back to confirm it was genuinely saved correctly, update it and confirm the actual change genuinely took effect, then delete it and confirm it's actually genuinely gone afterward.

Delete the created resource explicitly at the actual end of the test, ideally in a teardown step that genuinely runs even if the test itself actually fails partway through, so leftover test data doesn't genuinely accumulate and eventually pollute the actual test environment over repeated runs.

Traditional API testing verifies actual, real behavior by genuinely calling a live, running service directly. Contract testing instead verifies that a consumer's own actual expectations and a provider's own actual API genuinely agree on the exact expected request and response shape, often without either side ever needing to actually genuinely run against the other live, real service directly at all.

Load testing sends a genuinely realistic, expected volume of concurrent requests to an API to observe its actual real behavior under that specific load. Key metrics include actual response time (average and specific percentiles, like the 95th), throughput (requests genuinely handled per second), and the actual error rate as load genuinely increases over time.

Load testing checks behavior under an actually expected, normal, realistic level of traffic. Stress testing pushes well beyond that normal level, deliberately, to actually find the genuine breaking point, and to observe exactly how the API genuinely fails once it's actually pushed past what it can reasonably handle.

JMeter and k6 are both widely used, letting you actually define a load profile, a specific number of concurrent users hitting genuinely specific endpoints, and generate a detailed report on the actual observed response times and genuine error rates under that defined load.

Base it on genuinely actual production traffic patterns wherever that real data is actually available, peak concurrent users, typical genuine request patterns, rather than an entirely arbitrary, made-up number. Testing against a genuinely unrealistic load profile can produce results that don't actually reflect how the API will genuinely behave under real-world, real production conditions.

It often points to a genuine underlying resource constraint, like database connection pool exhaustion, insufficient server capacity, or an actual inefficient query that only genuinely becomes visible once concurrency meaningfully increases. Correlating the actual API's own observed response time with backend metrics, like database query time, usually helps pinpoint the exact real, specific cause.

Service virtualization simulates an actual dependent service's genuine behavior more fully, including realistic response timing and various different scenarios, specifically for integration testing purposes, at a genuinely broader scale than a simple unit-test mock typically would. It's used when a real, genuine dependency is unavailable, unreliable, or actually too costly to actually call repeatedly during frequent, regular testing.

Combine contract testing between genuinely dependent services to catch a breaking API change early, with a genuinely smaller, more targeted set of real end-to-end tests reserved specifically for the most critical, real cross-service business flows. Relying purely on full end-to-end tests across every single actual service combination becomes genuinely impractical and prohibitively slow at that kind of real scale.

Smoke tests should cover the genuinely most critical, most frequently used endpoints, running quickly enough to actually provide fast, immediate feedback on every single build. The genuinely fuller regression suite can cover a much broader, deeper range of scenarios, including edge cases and genuinely less common paths, run less frequently, since it naturally takes meaningfully longer to actually complete.

I'd favor contract testing and a genuinely stronger emphasis on schema validation specifically during that active development phase, since those approaches catch a genuinely breaking change quickly without needing an entire, full end-to-end test suite to actually be rewritten every single time the API itself genuinely changes.

I'd weigh the actual, concrete gap the new tool would genuinely fill, better GraphQL support, genuinely faster execution, more capable contract testing, against the real cost of a team learning something genuinely new and any existing test suite that would actually need real migration effort as part of that same transition.

Mock the external third-party dependencies for the genuine majority of automated test runs, to actually keep those tests fast and reliable, while reserving genuinely real calls to the actual third-party service for a genuinely smaller, separate, and more targeted set of integration tests specifically designed to actually verify that real, live connection still genuinely works correctly.

The pipeline triggers the actual test suite to run automatically on every single build or genuine deployment, typically right after a service has actually been deployed to a test environment, failing the overall build outright if a genuinely critical API test actually fails, before that specific change can actually proceed any further toward production.

Generate a genuinely structured report clearly showing exactly which specific endpoint and which specific assertion actually failed, along with the actual full request and response details captured right at the exact moment of that specific failure, rather than relying purely on a raw console log that's genuinely hard to scan quickly for a specific failure among many other tests.

Externalize environment-specific values into configuration files or actual environment variables, selected dynamically at genuine runtime based on which specific environment the test suite is actually currently targeting, rather than hardcoding a specific URL directly inside the actual test code itself.

Synthetic monitoring periodically and automatically sends real requests to genuinely critical, live production endpoints, alerting immediately if the response is unexpectedly slow or genuinely incorrect. This catches a real, live production issue, like a downstream dependency actually failing, that pre-release testing alone genuinely couldn't have caught in advance, since it hadn't actually happened yet at that earlier point.

Run the most genuinely critical smoke tests on every single build, for the fastest possible feedback. Run a fuller, more thorough regression suite less frequently, perhaps nightly, or specifically before an actual release, since it naturally takes meaningfully longer but doesn't necessarily need to genuinely run on every single individual commit.

I'd suspect an actual environment difference first, timing, genuinely shared test data between parallel test runs, or a real network issue genuinely specific to the actual CI environment itself, rather than immediately assuming it's purely the underlying API's own actual fault. Adding more detailed actual logging specifically around the failure point in CI usually genuinely helps narrow down the real, specific, actual cause faster.

Run both the old and new suites fully in parallel for a defined transition period, comparing their actual results directly against each other to genuinely confirm the new suite is truly catching everything the old one already did, before actually retiring the legacy suite for good. Migrating test by test incrementally, rather than one single, large, disruptive rewrite, keeps genuine coverage intact throughout that whole transition.

I check whether the actual API follows genuinely consistent conventions with other existing APIs across the organization, whether error responses are genuinely clear and consistently structured, and whether the design will actually hold up reasonably well as real consumers and their genuine needs continue to evolve and grow over time.

Automate what can genuinely be automated, required contract tests and schema validation checks enforced directly in each team's own CI pipeline, so standards aren't purely a matter of individual opinion during manual code review. For conventions that genuinely resist full automation, I'd document the handful of decisions that actually matter most, along with the real reasoning behind each one.

I'd weigh the actual, real cost of past breaking-change incidents that contract testing would have genuinely caught earlier, against the real setup and ongoing maintenance cost of actually adopting and maintaining it consistently across many teams. It's genuinely most valuable specifically in a microservices architecture with frequent, independent deployments across many genuinely interdependent services.

I'd suspect the actual pre-release test's load profile itself may not genuinely reflect real, actual production traffic patterns closely enough. Distributed tracing and genuine production monitoring often reveal that the actual real bottleneck, a downstream dependency, a database query, only genuinely surfaces under real, sustained, actual production load, which a pre-release test's own necessarily simplified conditions simply couldn't have fully anticipated in advance.

Track response latency, error rate, and throughput over time, alerting on a meaningful deviation from an established, normal baseline, rather than relying purely on a hard, static threshold alone. I'd also specifically track latency by individual endpoint, since one genuinely slow endpoint can otherwise hide within an overall, aggregated average that still looks perfectly fine at a glance.

Treat the API's actual contract as a genuine, real commitment to every single consumer. Additive changes, a genuinely new optional field, are generally safe. Changing or removing something existing needs a documented deprecation period and direct, proactive communication well before actual removal, rather than a silent breaking change that quietly surfaces later as someone else's completely unrelated-seeming production incident.

I'd check first for a genuine change in traffic volume or a specific pattern shift, and for the actual health of any downstream dependencies that API genuinely relies on, since a slowdown with no code change is very often caused by something else entirely in its own broader dependency chain, not the actual API's own code itself.

Start from actual load testing at genuinely realistic traffic shapes rather than a purely theoretical calculation, since the real bottleneck, a database, a downstream API's own rate limit, often shows up well before the target load and doesn't necessarily scale linearly with simple, raw traffic volume alone.

This is a judgment question interviewers use to see how you reason under genuine uncertainty, not to test a specific textbook fact. A strong answer names the actual constraint that forced the decision, the realistic options that were genuinely on the table, why you picked one knowing it wasn't guaranteed to be right, and what you'd do differently with what you know now.

I'd have them convert one of their own already-existing, actual Postman tests into automated code together, showing directly how the exact same underlying logic they already genuinely understand translates into actual code, rather than treating automation as a genuinely entirely separate, unfamiliar new skill to learn completely from scratch.

I wouldn't lead with contract testing as an abstract best practice. I'd point to a specific, real, already-experienced incident where a breaking API change genuinely broke a dependent, downstream service, and show concretely how contract testing would have actually caught that exact same specific issue well before it ever genuinely reached production.

I'd bring the actual, concrete impact on existing, real consumers directly into the discussion, rather than a purely abstract, technical debate about what a breaking change technically genuinely means in isolation. If even one genuinely real, existing consumer would actually break from that specific change, it's a breaking change in practice, regardless of how small or seemingly minor it might otherwise appear on the surface.

I'd translate it into terms leadership already tracks: the cost of a specific past incident caused by a breaking API change, and the engineering hours spent firefighting it compared to what a contract test would have cost to write and maintain. Framed as risk reduction with a real, already-incurred cost behind it, it competes far better for prioritization than framed as a general testing improvement.