API Testing Interview Questions and Answers

Sample questions

A few questions from each level with the correct answer and an explanation.

API Testing · Junior

1. What is API testing?
   ▸Show the answer

   Correct answer: Checking an application's interface for programs directly, without the UI

   API tests send requests to endpoints and verify status codes, bodies, headers and side effects. They're faster and more stable than UI tests and reach cases the UI hides.

2. Why is API testing often done before UI testing?
   ▸Show the answer

   Correct answer: The API is ready earlier and bugs there are cheaper to find

   Backend endpoints usually exist before screens. Testing them early finds logic and validation bugs while the UI is still being built.

3. What does a REST API usually use to identify resources?
   ▸Show the answer

   Correct answer: URLs such as /users/42

   In REST, each resource has an address, and HTTP methods say what to do with it: GET /users/42 reads it, DELETE /users/42 removes it.

4. Which HTTP method should only read data?
   ▸Show the answer

   Correct answer: GET

   GET is a safe method: it must not change server state. A GET that deletes or updates something is a bug, since caches, crawlers and prefetching may call it.

API Testing · Middle

1. Why move API checks from Postman into code-based tests over time?
   ▸Show the answer

   Correct answer: Code lives in Git with review, reuse and normal CI tooling

   Tests in the same repo as the service are reviewed with the code, share helpers and run like any test suite. Postman stays useful for exploration.

2. What is REST Assured?
   ▸Show the answer

   Correct answer: A Java library for writing readable API tests

   It offers a given/when/then style: given().body(...).when().post("/users").then().statusCode(201).

3. How do you validate a response body against a JSON Schema in JavaScript tests?
   ▸Show the answer

   Correct answer: Compile the schema with a validator like Ajv and check the body

   Ajv returns validation errors with paths like /items/0/price, which makes failures easy to read.

4. What does additionalProperties: false in a response schema catch?
   ▸Show the answer

   Correct answer: Unexpected fields, such as leaked internal data

   Strict schemas detect new or leaked fields like passwordHash. Teams decide per API whether strictness helps or causes noise.

API Testing · Senior

1. How should API tests be split across levels for a microservice?
   ▸Show the answer

   Correct answer: Many unit and component tests, contracts between services, few E2E flows

   Component tests run the service with stubbed dependencies and cover logic fast. Contracts guard integrations; a handful of E2E flows prove the whole system works.

2. What does Pact's can-i-deploy check answer?
   ▸Show the answer

   Correct answer: Whether this version is verified against the versions it talks to

   The Pact Broker knows which consumer and provider versions verified each contract. The check blocks a deploy that would break a partner already in production.

3. What is the main risk of contract tests written by the provider team only?
   ▸Show the answer

   Correct answer: They test what the provider thinks clients use, not what they use

   Consumer-driven contracts capture real usage. Provider-only contracts often miss fields a client depends on, or test fields nobody uses.

4. Why review an API design before code is written?
   ▸Show the answer

   Correct answer: Changing a published contract later is expensive for all clients

   Spec-first reviews catch unclear errors, missing pagination or inconsistent naming when fixing them costs one edit, not a versioned migration.

Combined quizzes with this topic

Questions from several topics at once - just like an interview for a specific role.