API Design Senior interview questions and answers

75 questions for a API Design (Senior) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.How do you choose between REST, GraphQL and gRPC for a new system?
  2. 2.What is an 'API as a product' mindset?
  3. 3.Why establish API governance (style guide, reviews, linting) in an organization with many teams?
  4. 4.How do Hyrum's Law and 'be conservative in what you send' interact in API evolution?
  5. 5.How does date-based API versioning (like Stripe's) work?
  6. 6.What's the main cost of supporting many API versions at once?
  7. 7.How can you remove a widely used field safely?
  8. 8.Why is changing default behavior (e.g. a default page size) a breaking change?
  9. 9.An API writes to a primary database and serves reads from replicas. A client creates an item and immediately lists items without seeing it. How should the API design handle this?
  10. 10.How should a multi-step operation spanning several services be exposed in an API?
  11. 11.How should idempotency keys behave when the first request is still in progress and a retry arrives?
  12. 12.How long should a server keep idempotency keys?
  13. 13.What problem does a 'thin event' webhook design solve?
  14. 14.How should a webhook system handle a subscriber that has been failing for days?
  15. 15.What are risks of sending webhooks to arbitrary customer-provided URLs?
  16. 16.How do you design an API endpoint whose underlying query is expensive and popular?
  17. 17.What does an API's p99 latency SLO imply for its dependencies?
  18. 18.How should a public API protect itself from abusive or expensive usage patterns?
  19. 19.What is cost-based rate limiting?
  20. 20.Why does HTTP/2 change the trade-offs around batching many small API requests?
  21. 21.Why are persisted (allow-listed) queries valuable for public GraphQL APIs?
  22. 22.How should a GraphQL schema model mutations for good client experience?
  23. 23.What's a risk of exposing database models directly as a GraphQL schema?
  24. 24.Why might introspection be disabled for a public GraphQL API in production?
  25. 25.What are the backward-compatibility rules for Protocol Buffers messages?
  26. 26.Which gRPC features go beyond a typical REST API?
  27. 27.How can you expose a gRPC service to browsers and REST clients without duplicating logic?
  28. 28.What's the difference between OWASP API1 (BOLA) and API5 (Broken Function Level Authorization)?
  29. 29.What does OWASP API6:2023 (Unrestricted Access to Sensitive Business Flows) warn about?
  30. 30.What does OWASP API9:2023 (Improper Inventory Management) refer to?
  31. 31.What does OWASP API10:2023 (Unsafe Consumption of APIs) cover?
  32. 32.Why should JWT access tokens for APIs be validated strictly?
  33. 33.What does mutual TLS (mTLS) add for service-to-service APIs?
  34. 34.How can an API minimize the impact of leaked credentials?
  35. 35.Which metrics best describe an API's health from the consumer's point of view?
  36. 36.How should SLOs for a public API be defined?
  37. 37.Why propagate W3C traceparent headers through APIs?
  38. 38.How can you roll out a risky API change safely?
  39. 39.What is the 'long-running operation' pattern in Google's API guidelines?
  40. 40.What problem do 'field masks' solve in update operations?
  41. 41.Why might an API use resource-oriented 'custom methods' like POST /orders/42:cancel?
  42. 42.How do you design pagination for a feed that must stay consistent while new items arrive?
  43. 43.What's a good way to expose computed aggregates that are expensive, like monthly revenue per customer?
  44. 44.How can an API support offline-first mobile clients?
  45. 45.What's the trade-off of exposing a generic query API (e.g. OData filters or raw GraphQL access to all data)?
  46. 46.Why can 'chatty' internal APIs become a problem in microservices?
  47. 47.What's a downside of putting too much logic into an API gateway?
  48. 48.How should an API handle personal data to support privacy requirements like GDPR?
  49. 49.Why should an API avoid sequential, guessable identifiers for sensitive resources even with authorization in place?
  50. 50.How should multi-tenant APIs prevent data leaks between tenants?
  51. 51.How do you choose between webhooks, SSE, WebSockets and polling for delivering updates?
  52. 52.How should a real-time API recover from disconnects without losing events?
  53. 53.Why document real-time and event APIs with AsyncAPI?
  54. 54.What is consumer-driven contract testing?
  55. 55.How can you detect which clients would break before changing an API's behavior?
  56. 56.Why can retries at several layers (client, gateway, service) cause 'retry storms'?
  57. 57.What is request hedging, and when is it appropriate?
  58. 58.How should an API communicate that a request was partially applied and can't be safely retried?
  59. 59.What does designing an API 'outside-in' mean?
  60. 60.Why might you provide official SDKs in addition to raw HTTP documentation?
  61. 61.What's the risk of tight coupling between an API's response shape and a single UI screen?
  62. 62.How should breaking changes to error formats be treated?
  63. 63.When does an API need explicit optimistic concurrency (ETags/If-Match) by default?
  64. 64.Why should timeouts be part of an API's documented contract?
  65. 65.How can you replace a legacy API with a new implementation without a big-bang switch?
  66. 66.What are scheduled 'brownouts' when retiring an API version?
  67. 67.How do you keep one large tenant from degrading a shared API for everyone?
  68. 68.When might an API offer Protobuf or another binary format in addition to JSON?
  69. 69.What's the risk of caching authenticated API responses at a CDN?
  70. 70.Why do event-driven APIs usually promise 'at-least-once' rather than 'exactly-once' delivery?
  71. 71.What is a schema registry used for in event-driven APIs (e.g. with Kafka)?
  72. 72.What does request signing (e.g. HMAC-based like AWS SigV4) add beyond a bearer token?
  73. 73.How should an API design handle data residency requirements (e.g. EU data stays in the EU)?
  74. 74.Why should pagination tokens be tied to the query that produced them?
  75. 75.Where should quotas and rate limits per plan be documented?