API Testing Junior interview questions and answers

75 questions for a API Testing (Junior) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.What is API testing?
  2. 2.Why is API testing often done before UI testing?
  3. 3.What does a REST API usually use to identify resources?
  4. 4.Which HTTP method should only read data?
  5. 5.Which method is usually used to create a new resource?
  6. 6.What is the difference between PUT and PATCH?
  7. 7.What do status codes starting with 2 mean?
  8. 8.What do 4xx status codes mean?
  9. 9.What do 5xx status codes mean?
  10. 10.A request with an invalid email returns 500. What is the problem?
  11. 11.What does 201 Created usually come with?
  12. 12.When is 204 No Content used?
  13. 13.What is the difference between 401 and 403?
  14. 14.What should GET /users/999 return if the user doesn't exist?
  15. 15.What should GET /users?name=zzz usually return when nothing matches?
  16. 16.What does 409 Conflict usually signal?
  17. 17.What does 429 Too Many Requests mean?
  18. 18.What does 415 Unsupported Media Type usually indicate?
  19. 19.What does the Content-Type request header tell the server?
  20. 20.What does the Accept header do?
  21. 21.How is a bearer token usually sent?
  22. 22.What is the difference between a path parameter and a query parameter?
  23. 23.What is Postman mainly used for?
  24. 24.What is a Postman collection?
  25. 25.Why use environments in Postman?
  26. 26.What does this Postman test check?
  27. 27.How do you reuse an ID from one response in the next request in Postman?
  28. 28.What is Newman?
  29. 29.What does this curl command do?
  30. 30.Which curl flag shows response headers along with the body?
  31. 31.How can you quickly get a failing request from a web app into a bug report?
  32. 32.What should an API bug report include?
  33. 33.What should you check in an API response besides the status code?
  34. 34.What is negative API testing?
  35. 35.A field accepts quantities from 1 to 100. Which values are boundary tests?
  36. 36.What should happen when a required field is missing from a POST body?
  37. 37.What do you test by sending "age": "twenty" instead of a number?
  38. 38.Which methods are idempotent by definition?
  39. 39.What should happen when you DELETE the same resource twice?
  40. 40.Why should API responses be checked for response time?
  41. 41.What is a JSON Schema used for in API testing?
  42. 42.What does OpenAPI (Swagger) describe?
  43. 43.What is a mock server in API testing?
  44. 44.What does it mean that HTTP is stateless?
  45. 45.How is API key authentication usually sent?
  46. 46.What is Basic authentication?
  47. 47.Why does a request work in Postman but fail with a CORS error in the browser?
  48. 48.What is an OPTIONS request with Access-Control-Request-Method in the browser?
  49. 49.Why test pagination with page and limit parameters?
  50. 50.What should a test check when sorting results with sort=price?
  51. 51.What should you test about date fields in an API?
  52. 52.Why send special characters like &, # or spaces in query parameters?
  53. 53.What is the main difference between GraphQL and REST for a tester?
  54. 54.A GraphQL response has status 200 and an errors array. Did the request succeed?
  55. 55.Why should API tests not depend on data that someone created by hand?
  56. 56.What is a pre-request script in Postman for?
  57. 57.Why shouldn't tokens and passwords be saved in shared Postman collections?
  58. 58.What should happen when an API receives an unknown field in a request body?
  59. 59.What is the risk of an API that returns more fields than the client needs?
  60. 60.What is an IDOR bug?
  61. 61.What does Content-Length mismatch or a cut-off JSON body usually indicate?
  62. 62.What is HEAD useful for?
  63. 63.What is the main goal of a smoke test for an API?
  64. 64.What does a health check endpoint like /health usually tell you?
  65. 65.Why should API tests run in CI?
  66. 66.What does API versioning like /v1/orders help with?
  67. 67.Why are HTTPS-only APIs important to check?
  68. 68.Are HTTP header names case-sensitive?
  69. 69.How should you test a PATCH that updates a user's name?
  70. 70.Why verify side effects after a successful POST?
  71. 71.What does a very long string, e.g. 10,000 characters, in a name field test?
  72. 72.Why test with Unicode such as emoji or Cyrillic in text fields?
  73. 73.What is the difference between authentication and authorization?
  74. 74.What should happen when a request uses an expired token?
  75. 75.What is a webhook from a tester's point of view?