API Design Junior interview questions and answers

75 questions for a API Design (Junior) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.What is a REST API, in practical terms?
  2. 2.Which URL design follows common REST conventions?
  3. 3.What does 'stateless' mean for a REST API?
  4. 4.Which HTTP method should create a new resource in a collection, like a new order?
  5. 5.What's the difference between PUT and PATCH?
  6. 6.Which HTTP methods are 'safe'?
  7. 7.Which methods are idempotent by HTTP semantics?
  8. 8.What should DELETE /orders/42 return if the order was deleted and there's nothing to send back?
  9. 9.What does the Location header in a 201 Created response contain?
  10. 10.Why should resource names in URLs usually be plural nouns, like /users?
  11. 11.What does 400 Bad Request mean?
  12. 12.What's the difference between 401 Unauthorized and 403 Forbidden?
  13. 13.Which status code fits 'email is already registered' when creating a user?
  14. 14.What does 429 Too Many Requests tell the client?
  15. 15.When should an API return 5xx codes?
  16. 16.What does 503 Service Unavailable usually mean?
  17. 17.Why is returning 200 OK with { "error": "not found" } a bad practice?
  18. 18.What does 404 Not Found mean for GET /orders/999?
  19. 19.What does the Content-Type: application/json request header tell the server?
  20. 20.What is the Accept header for?
  21. 21.How should dates and times be represented in a JSON API?
  22. 22.Why might an API return large numeric IDs as strings in JSON?
  23. 23.Which field naming style should a JSON API use?
  24. 24.Where should filtering and sorting options go in a REST request?
  25. 25.What does a good error response body include?
  26. 26.What is RFC 9457 (Problem Details)?
  27. 27.Why should list endpoints be paginated?
  28. 28.What's the difference between offset and cursor pagination?
  29. 29.Why should a pagination cursor be opaque to clients?
  30. 30.How can an API tell clients there are more pages?
  31. 31.How is a bearer token usually sent to an API?
  32. 32.Why must APIs be served only over HTTPS?
  33. 33.What is an API key typically used for?
  34. 34.What is OAuth 2.0 mainly about?
  35. 35.What does CORS control?
  36. 36.Why should an API validate all input even if the official client already does?
  37. 37.What is OpenAPI?
  38. 38.What's the benefit of a 'design-first' API approach?
  39. 39.Why should an API have a style guide?
  40. 40.What is JSON Schema used for in APIs?
  41. 41.Which change to an existing API response is usually backward compatible?
  42. 42.What is a common way to version a REST API?
  43. 43.Why should clients ignore unknown fields in responses?
  44. 44.How should an API announce that an endpoint will be removed?
  45. 45.Which responses can HTTP caches store most safely?
  46. 46.What is an ETag?
  47. 47.Why might an API compress responses?
  48. 48.What is GraphQL?
  49. 49.What is a webhook?
  50. 50.What is gRPC typically used for?
  51. 51.What's the difference between REST and RPC style APIs?
  52. 52.When do Server-Sent Events fit better than polling?
  53. 53.What does HEAD /files/report.pdf return?
  54. 54.Why are CORS preflight OPTIONS requests sent?
  55. 55.How should nested resources be used in URLs?
  56. 56.What's a sensible maximum for a list endpoint's limit parameter?
  57. 57.Why might an API use a request ID header like X-Request-Id?
  58. 58.Which tool is commonly used to try API requests manually?
  59. 59.What does 'over-fetching' mean?
  60. 60.What does 'under-fetching' (or chatty API) mean?
  61. 61.Should an API expose internal database IDs and table structure directly?
  62. 62.How should boolean flags be named in API payloads?
  63. 63.Why are enums in API responses tricky to extend?
  64. 64.What should a GET request never do?
  65. 65.What does Retry-After: 120 in a response mean?
  66. 66.What is the Richardson Maturity Model?
  67. 67.What is HATEOAS?
  68. 68.A user double-clicks 'Pay', and the client sends POST /payments twice. What's the risk and a common fix?
  69. 69.What does 202 Accepted mean?
  70. 70.How can a client follow a long-running operation started with 202 Accepted?
  71. 71.When is it fine to create a resource with PUT?
  72. 72.Why do many APIs return { "data": [...] } instead of a bare JSON array for lists?
  73. 73.What do headers like RateLimit-Remaining (or X-RateLimit-Remaining) give clients?
  74. 74.How can a client fetch several users by ID in one request in a REST API?
  75. 75.What's a common query parameter name for free-text search in a collection?