API Testing Interview Questions

What is the difference between PUT and PATCH? When do you test each?

Which HTTP status codes must an API tester know cold, and what do you assert beyond them?

200/201/202, 204, 301/302, 400, 401 vs 403, 404, 409, 422, 429, 500/502/503 — and beyond the code you assert body schema, headers, and side effects.

How do you test idempotency and retries?

Send the same request twice with the same Idempotency-Key and assert one resource is created; GET, PUT and DELETE must be naturally idempotent, POST needs a key.

How do you validate a response schema, and why is that better than field-by-field asserts?

Validate against a JSON Schema (or the OpenAPI spec) so types, required fields and enums are checked in one assertion that fails when the contract drifts.

How do you handle OAuth2 / JWT authentication in an API suite?

Fetch a token once per run through the client-credentials or password grant, cache it until shortly before expiry, and attach it via a request specification — never hardcode tokens.

How do you chain requests and manage test data for API tests?

Create prerequisites through the API itself, extract ids from the response, pass them to the next call, and clean up in teardown — no dependence on pre-seeded records.

What is HTTP methods, and why does it matter in API Testing?

HTTP methods is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply HTTP methods in a production API Testing project?

Apply HTTP methods through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is idempotency, and why does it matter in API Testing?

idempotency is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply idempotency in a production API Testing project?

Apply idempotency through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is status codes, and why does it matter in API Testing?

status codes is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply status codes in a production API Testing project?

Apply status codes through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is request headers, and why does it matter in API Testing?

request headers is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply request headers in a production API Testing project?

Apply request headers through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is content negotiation, and why does it matter in API Testing?

content negotiation is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply content negotiation in a production API Testing project?

Apply content negotiation through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is path and query parameters, and why does it matter in API Testing?

path and query parameters is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply path and query parameters in a production API Testing project?

Apply path and query parameters through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is request bodies, and why does it matter in API Testing?

request bodies is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply request bodies in a production API Testing project?

Apply request bodies through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is authentication, and why does it matter in API Testing?

authentication is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply authentication in a production API Testing project?

Apply authentication through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is authorization, and why does it matter in API Testing?

authorization is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply authorization in a production API Testing project?

Apply authorization through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is pagination, and why does it matter in API Testing?

pagination is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply pagination in a production API Testing project?

Apply pagination through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is sorting and filtering, and why does it matter in API Testing?

sorting and filtering is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply sorting and filtering in a production API Testing project?

Apply sorting and filtering through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is schema validation, and why does it matter in API Testing?

schema validation is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply schema validation in a production API Testing project?

Apply schema validation through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is contract testing, and why does it matter in API Testing?

contract testing is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply contract testing in a production API Testing project?

Apply contract testing through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is negative testing, and why does it matter in API Testing?

negative testing is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply negative testing in a production API Testing project?

Apply negative testing through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is boundary testing, and why does it matter in API Testing?

boundary testing is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply boundary testing in a production API Testing project?

Apply boundary testing through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is rate limiting, and why does it matter in API Testing?

rate limiting is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply rate limiting in a production API Testing project?

Apply rate limiting through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is retries, and why does it matter in API Testing?

retries is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply retries in a production API Testing project?

Apply retries through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is timeouts, and why does it matter in API Testing?

timeouts is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply timeouts in a production API Testing project?

Apply timeouts through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is caching, and why does it matter in API Testing?

caching is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply caching in a production API Testing project?

Apply caching through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is ETags, and why does it matter in API Testing?

ETags is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply ETags in a production API Testing project?

Apply ETags through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is eventual consistency, and why does it matter in API Testing?

eventual consistency is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply eventual consistency in a production API Testing project?

Apply eventual consistency through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is webhooks, and why does it matter in API Testing?

webhooks is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply webhooks in a production API Testing project?

Apply webhooks through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is GraphQL testing, and why does it matter in API Testing?

GraphQL testing is a core API Testing concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply GraphQL testing in a production API Testing project?

Apply GraphQL testing through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.