API Testing Middle interview questions and answers

75 questions for a API Testing (Middle) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.Why move API checks from Postman into code-based tests over time?
  2. 2.What does SuperTest let you do in a Node.js project?
  3. 3.What is REST Assured?
  4. 4.How do you validate a response body against a JSON Schema in JavaScript tests?
  5. 5.What does additionalProperties: false in a response schema catch?
  6. 6.What is consumer-driven contract testing?
  7. 7.What can contract tests catch that unit tests on each side can't?
  8. 8.When is an OpenAPI-based contract check a good alternative to Pact?
  9. 9.What does WireMock provide?
  10. 10.Why simulate a slow dependency in an API test?
  11. 11.What is the difference between 502, 503 and 504?
  12. 12.An endpoint returns 202 Accepted. How should a test continue?
  13. 13.What is an idempotency key for a POST request?
  14. 14.How do you test that an API handles a double-click on "Pay" safely?
  15. 15.What does If-Match with an ETag protect against?
  16. 16.What should a request with If-None-Match and a matching ETag return?
  17. 17.Why check Cache-Control headers on API responses?
  18. 18.How do you test a rate limit of 100 requests per minute?
  19. 19.What is a known problem of offset pagination like ?page=3?
  20. 20.What should you test for cursor-based pagination?
  21. 21.What is mass assignment in an API?
  22. 22.What is broken function level authorization?
  23. 23.How do you systematically test object-level authorization?
  24. 24.Which test input checks for SQL injection in a search parameter?
  25. 25.What should an error response for invalid input look like?
  26. 26.Why is a database error message in an API response a security finding?
  27. 27.Why do correlation or request IDs help API testing?
  28. 28.In the OAuth 2.0 client credentials flow, who gets the token?
  29. 29.What should you test about refresh tokens?
  30. 30.Which JWT checks should an API tester try?
  31. 31.Why can a JWT be decoded by anyone who has it?
  32. 32.How do you test file upload with multipart/form-data?
  33. 33.What does 413 Content Too Large mean?
  34. 34.Which change to a JSON response is usually backward compatible?
  35. 35.How should a tester check an API deprecation?
  36. 36.What is data-driven testing in API tests?
  37. 37.Why are monetary amounts often sent as strings or integers of cents?
  38. 38.What should a test check about time zones in an API?
  39. 39.How do you make API tests independent of each other?
  40. 40.What is a common cause of flaky API tests?
  41. 41.What does a test of webhook delivery need to check?
  42. 42.Why verify a webhook signature?
  43. 43.What is GraphQL query depth or complexity limiting for?
  44. 44.Why might GraphQL introspection be disabled in production?
  45. 45.What is the N+1 problem in an API?
  46. 46.What is special about testing a gRPC API?
  47. 47.How should API tests handle environment-specific values?
  48. 48.Why add security header checks to API tests?
  49. 49.How do you test CORS configuration of an API?
  50. 50.What does Postman's pm.response.to.have.jsonSchema(schema) do?
  51. 51.What are Postman dynamic variables like {{$guid}} useful for?
  52. 52.How do you test that an API validates enum values?
  53. 53.Why check that error responses have the right Content-Type?
  54. 54.What is the benefit of running API tests against a preview environment per pull request?
  55. 55.How do you test eventual consistency between two services after an API call?
  56. 56.What should you test about a search endpoint's filters?
  57. 57.What does compression like Content-Encoding: gzip mean for API tests?
  58. 58.Why test an API with an old client version after a release?
  59. 59.What is the role of mocks like MSW for frontend tests of API errors?
  60. 60.What should you check when an API returns lists of items?
  61. 61.How should a test handle values generated by the server, like IDs and timestamps?
  62. 62.What does API fuzzing do?
  63. 63.What does Schemathesis do?
  64. 64.How do you test that deleting a parent resource handles its children?
  65. 65.Why log full requests and responses in failing API test reports?
  66. 66.What is the main value of a smoke collection run after each deploy?
  67. 67.How do you test API behaviour when a downstream service returns invalid JSON?
  68. 68.Why test timeouts on the client side of an API integration?
  69. 69.What should you test about retries in an API client?
  70. 70.How can you test an API's behaviour under a dependency outage without breaking staging?
  71. 71.What does 405 Method Not Allowed require from the server?
  72. 72.What does 406 Not Acceptable mean?
  73. 73.Why check that field naming is consistent, e.g. camelCase everywhere?
  74. 74.How do you test that a list endpoint doesn't show soft-deleted items?
  75. 75.What does Retry-After on a 503 response tell clients?