API Testing Senior interview questions and answers

75 questions for a API Testing (Senior) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.How should API tests be split across levels for a microservice?
  2. 2.What does Pact's can-i-deploy check answer?
  3. 3.What is the main risk of contract tests written by the provider team only?
  4. 4.Why review an API design before code is written?
  5. 5.How can API style rules be enforced across many teams?
  6. 6.What is a sensible backward-compatibility policy for a public API?
  7. 7.Why are synthetic API checks in production useful even with a full test suite?
  8. 8.What is the difference between open and closed workload models in load testing?
  9. 9.Why report p95 and p99 latency rather than averages in API load tests?
  10. 10.What is coordinated omission in load testing?
  11. 11.How should a load test define success?
  12. 12.What does a soak test reveal for an API that a short load test misses?
  13. 13.What is BOLA, number one in the OWASP API Top 10 (2023)?
  14. 14.What does "broken object property level authorization" cover?
  15. 15.What is "unrestricted resource consumption" in API security?
  16. 16.How do you test for SSRF in an API that fetches a URL you provide?
  17. 17.What is "unrestricted access to sensitive business flows"?
  18. 18.Why is "improper inventory management" an API risk?
  19. 19.How should a service consuming third-party APIs be tested for safety?
  20. 20.How do you test an event-driven API that publishes to a message broker?
  21. 21.What must consumers of at-least-once message delivery be tested for?
  22. 22.Why test message ordering assumptions in async APIs?
  23. 23.What is a dead-letter queue and how is it tested?
  24. 24.How do schema registries help test event contracts?
  25. 25.How do you test a saga that spans several services?
  26. 26.What is multi-tenant isolation testing?
  27. 27.How should a GDPR data deletion request be tested end to end?
  28. 28.Why check API logs for personal data in tests?
  29. 29.What is the main challenge of using production traffic recordings for API tests?
  30. 30.How can mocks of a dependency drift from reality, and how do you catch it?
  31. 31.What does property-based testing add to API test suites?
  32. 32.What is the oracle problem in API testing, and a way around it?
  33. 33.How do you decide between Postman collections and code-based API tests for a team?
  34. 34.What are the limits of AI-generated API tests?
  35. 35.How can traces from observability tools improve API tests?
  36. 36.What should a quality gate for an API service check before deploy?
  37. 37.How should API test runtime be managed as the suite grows?
  38. 38.How do SLOs and error budgets guide API testing priorities?
  39. 39.How should error responses be covered by contracts?
  40. 40.What is a good strategy for testing a CDN or cache in front of an API?
  41. 41.How do you test that an API rate limiter works across several instances?
  42. 42.What should be tested for long-running operations exposed via API?
  43. 43.What is the advantage of component tests that start one service with real DB in containers?
  44. 44.How do you test GraphQL authorization properly?
  45. 45.Why test API responses with very large datasets?
  46. 46.What is a safe way to test destructive endpoints in a shared environment?
  47. 47.What should be tested when an API adds a new required request field?
  48. 48.How do you test webhook delivery at scale?
  49. 49.What is the trade-off of testing against a shared staging environment?
  50. 50.How should flaky API tests be measured and handled?
  51. 51.How can mutation testing evaluate an API test suite?
  52. 52.What should a test strategy say about third-party API sandboxes?
  53. 53.How do you test time-dependent API behaviour like token expiry deterministically?
  54. 54.Why include negative tests in API contract tests?
  55. 55.What is API inventory testing in a large organization?
  56. 56.How do you test that an API degrades gracefully when a non-critical dependency fails?
  57. 57.What makes chaos experiments on APIs safe?
  58. 58.How should API tests handle feature flags?
  59. 59.How do you test API localization, e.g. error messages in several languages?
  60. 60.Why should API error codes, not messages, be what clients and tests rely on?
  61. 61.How do you test that an API never returns data from a cache after a user's permissions change?
  62. 62.What is the role of API tests in a zero-downtime deployment?
  63. 63.How do you test database migrations that change an API's data?
  64. 64.What should be measured to know whether API testing is effective?
  65. 65.Why is it useful to version and review test data definitions like code?
  66. 66.How do you test that an API enforces limits on expensive operations, like exports?
  67. 67.What is a safe practice for API tests that need real secrets in CI?
  68. 68.How do you approach testing an API with no documentation?
  69. 69.What is the benefit of generating client SDKs from the OpenAPI spec in tests?
  70. 70.How should an API team handle a breaking change that slipped into production?
  71. 71.What do you check when an API moves from one auth scheme to another?
  72. 72.Why include API tests in incident post-mortems?
  73. 73.What is the main purpose of AsyncAPI for testers?
  74. 74.What does a test for X-Forwarded-For spoofing check?
  75. 75.How should breaking-change detection be automated for OpenAPI specs?