API Testing Interview Questions with Practical Answers

What is API testing, and what does it validate?

A useful answer goes beyond status codes. Validate the body and headers, authorization rules, persisted data, emitted events, dependency behavior, and whether failures are safe and observable.

What REST concepts should a QA engineer understand?

Resources are usually nouns such as /users/123 or /orders/42/items. The contract defines operations, formats, authentication, error behavior, and compatibility.

GET /api/users/123 HTTP/1.1
Accept: application/json
Authorization: Bearer <token>

How do GET, POST, PUT, PATCH, and DELETE differ?

Which HTTP status codes matter most in API testing?

• 200 successful read or update
• 201 created, often with a Location header
• 204 success with no body
• 400 malformed or invalid request
• 401 missing or invalid authentication
• 403 authenticated but unauthorized
• 404 not found or intentionally concealed
• 409 state or uniqueness conflict
• 422 semantic validation where used
• 429 rate limit exceeded
• 500/502/503/504 server, gateway, or availability failure

Assert the documented code, error schema, absence of unsafe side effects, and a safe diagnostic signal—not a favorite code in isolation.

What do you validate in headers, path parameters, and query parameters?

• Missing, duplicate, malformed, and case-sensitive headers
• Encoded path values and unauthorized resource identifiers
• Repeated query keys, blanks, special characters, and defaults
• Filtering, sorting, and pagination combinations

How do you validate an API response?

1. Status, content type, headers, and response-time signal
2. Required, optional, nullable, and additional fields
3. Types, formats, ranges, enums, and cross-field rules
4. Business values against controlled data
5. Database, queue, or downstream side effects when observable
6. No secrets or stack traces in errors

{
  "id": "usr_123",
  "status": "active",
  "roles": ["candidate"]
}

Authentication and authorization: what is the difference?

For Bearer or JWT access, test missing, malformed, expired, revoked, wrong-audience, and wrong-scope tokens. A JWT is a signed token format, not proof that authorization rules are correct.

What is API chaining?

POST /api/orders              -> capture orderId
GET  /api/orders/{orderId}    -> verify persisted order
POST /api/orders/{orderId}/pay -> capture payment status

Keep end-to-end chains focused. Most regression tests should create controlled state so one failure does not obscure every downstream assertion.

What is schema validation, and is it enough?

A schema may allow any positive number while the business requires total = subtotal + tax. Combine contract assertions with targeted business rules.

How do you design positive, negative, and boundary tests?

What is idempotency, and how would you test it?

How do you test pagination, filtering, and sorting?

• First, middle, last, empty, and beyond-range pages
• Page-size minimum, maximum, default, and invalid values
• Stable sort with a deterministic tie-breaker
• No duplicates or gaps across an unchanged dataset
• Filter combinations and URL encoding
• Cursor expiry or invalid cursor behavior

How should rate limits, retries, and timeouts be tested?

Use bounded attempts and backoff. Avoid retrying permanent 4xx failures. Pair state-changing retries with idempotency or reconciliation.

How do you test API error handling and dependency failures?

• Database unavailable or slow
• Downstream 4xx, 5xx, timeout, or malformed response
• Queue or event publication failure
• Partial failure after one step committed
• Unsupported media type or malformed JSON

{
  "code": "ORDER_DEPENDENCY_UNAVAILABLE",
  "message": "Order could not be completed",
  "correlationId": "corr_8f31"
}

When should a QA engineer validate the database?

Check values, relationships, uniqueness, audit fields, and rollback behavior. Avoid coupling every test to internal tables.

How do Postman collections and environments support testing?

Keep secrets outside exported collections, add clear assertions, and run stable collections through the CLI in CI. Collection order should not be the only state setup.

What makes an API automation strategy maintainable?

• Reusable clients without hiding intent
• Controlled data creation and cleanup
• Contract plus targeted business assertions
• Parallel-safe unique identifiers
• Sanitized diagnostics and correlation IDs
• Fast smoke plus broader scheduled regression

What security considerations should QA cover?

Test horizontal and vertical authorization, mass assignment, unexpected fields, oversized input, unsafe errors, and secrets in logs. Use approved tools and environments; never perform intrusive testing without authorization.

How do you approach API performance questions?

Distinguish a functional response-time assertion from load, stress, soak, and spike testing. Report the environment, data, caching state, and workload.

Give a realistic end-to-end API test scenario

Order creation scenario

1. Create an authenticated user and controlled product stock.
2. POST a valid order; assert 201, schema, totals, ownership, and one persisted order.
3. GET as its owner; deny a second user.
4. Repeat with one idempotency key and assert no duplicate.
5. Try zero, excessive, unavailable, and malformed quantities.
6. Force payment or inventory failure and verify rollback or recoverable state.
7. Verify logs or events use a correlation identifier without sensitive data.