API Testing
Interview Questions

1

Fundamentals

What is an API, and what is API testing?

An API (Application Programming Interface) is a contract that lets two pieces of software talk: one sends a *request*, the other sends back a *response* — neither needs to know the other's internals. API testing…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

2

REST

What is REST, and what makes an API RESTful?

REST (Representational State Transfer) is a style for web APIs built around resources (things like users, orders), each with its own URL, acted on with standard HTTP methods.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

3

HTTP

What are the common HTTP methods, and what does each do?

The HTTP methods are the *verbs* of an API — each tells the server what action to perform on a resource.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

4

HTTP

What are the HTTP status code categories?

Every HTTP response carries a three-digit status code, and the first digit tells you the whole family at a glance.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

5

HTTP

Which status codes do you check most often in API testing, and what does each mean?

These are the everyday status codes a tester asserts on in almost every suite.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

6

HTTP

What is the difference between 401 Unauthorized and 403 Forbidden?

Both refuse the request, but for opposite reasons — one is about *identity*, the other about *permission*.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

7

HTTP

What is the difference between PUT and POST?

Both can create data, but they differ on *who picks the ID* and *what happens if you call them twice*.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

8

HTTP

What is the difference between PUT and PATCH?

Both update an *existing* resource, but they treat the fields you *omit* very differently.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

9

HTTP

What are the parts of an HTTP request?

An HTTP request has four parts, and each is a place where a test can pass or fail.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

10

HTTP

What does an HTTP response contain?

An HTTP response has three parts, and a thorough test asserts on all three — not just the first.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

11

HTTP

What is the difference between request and response headers? Name some common ones.

Headers carry *metadata* about the request or response (not the main data itself) — and which direction they travel matters.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

12

Data Formats

What is JSON, and why do APIs use it?

JSON (JavaScript Object Notation) is a lightweight, human-readable text format for structured data — key/value pairs, arrays, and nesting.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

13

HTTP

What is the difference between path parameters, query parameters, and the request body?

These are the three places a request carries data, and each has a distinct job.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

14

Fundamentals

What is an API endpoint?

An endpoint is a specific URL where an API receives requests for a particular resource or action — the base URL + a path, usually paired with an HTTP method.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

15

Fundamentals

What is the difference between SOAP and REST?

They solve the same problem — software talking to software — but with very different philosophies.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

16

Security

What is the difference between authentication and authorization in APIs?

Two different security questions that are easy to confuse.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

17

Security

What are the common API authentication methods?

There are four you'll meet constantly, from simplest to most sophisticated.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

18

HTTP

What does "idempotent" mean, and which HTTP methods are idempotent?

An operation is idempotent if doing it multiple times has the *same effect as doing it once*.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

19

Tools

What is Postman, and how do you use it for API testing?

Postman is a popular tool for sending API requests and inspecting responses *without writing code*.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

20

Fundamentals

What is CRUD, and how does it map to HTTP methods?

CRUD is the four basic data operations, and each maps cleanly to an HTTP method.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

21

Practical

What do you check when testing an API?

Cover several angles on every endpoint — a status-only check is not API testing.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

22

Fundamentals

What is the difference between an API and a web service?

All web services are APIs, but not all APIs are web services.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

23

HTTP

What is the difference between the Content-Type and Accept headers?

Both name a data format, but they point in opposite directions.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

24

HTTP

What is the difference between GET and POST?

The two most common methods, differing in *intent*, *where data goes*, and *safety*.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

25

Data Formats

What is the difference between JSON and XML?

Both structure data, but they trade off simplicity against formality.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

26

REST

How should RESTful API URLs (resources) be structured?

Use nouns, not verbs, and let the URL show the hierarchy — the HTTP *method* supplies the action.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

27

Debugging

You send a POST request and get a 500 error. What is your first step?

Don't guess — gather information systematically before raising anything.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

28

Practical

Walk me through the test cases you would write for a login API.

A login API is security-critical, so coverage spans happy path, negatives, security, and a data check.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

29

Practical

How do you test pagination in an API?

Pagination breaks a big list into pages via params like page, limit/per_page, or cursor tokens — and the edges are where it breaks.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

30

Tools

You need to test a protected endpoint that requires a valid auth token. How do you set that up in Postman?

Log in once, capture the token, and reuse it — there are two clean ways to do it in Postman.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

31

Practical

How do you verify that a POST request actually created the resource correctly?

Never trust the POST response alone — verify via a follow-up GET.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

32

Debugging

An API returns 200 OK but the response body has wrong or missing data. How do you handle it?

A 200 with wrong data is often worse than a 4xx — it's a silent failure no status code will warn you about.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

33

Tools

What is Swagger / OpenAPI and how do you use it during testing?

Swagger (OpenAPI) is a standard format for documenting REST APIs — every endpoint, method, request param, request/response schema, status code, and auth requirement in one machine-readable file (JSON/YAML), usually rendered as interactive UI.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

34

Practical

How do you test required vs optional fields in a request body?

Required and optional fields need *opposite* expectations, so test them as two distinct sets.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

35

Practical

You are asked to test a DELETE endpoint. What test cases do you cover?

DELETE is destructive, so coverage spans the happy path, authorization, side effects, and idempotency.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

36

Practical

What is API chaining and when do you use it in tests?

API chaining means feeding the output of one call into the input of the next — because real user journeys span multiple dependent calls.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

37

Practical

How do you test a search API that accepts multiple filter parameters?

Test each filter alone, in combination, at its boundaries, and alongside sorting/pagination — always verifying the *contents*, not just the status.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

38

Testing Concepts

What is the difference between smoke testing and regression testing an API?

Two different goals: smoke asks "is it alive?", regression asks "did we break anything that used to work?"

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

39

Negative Testing

How do you test that an API handles malformed or invalid JSON in the request body?

Send deliberately broken payloads and assert the API rejects them *cleanly* — with a 400, never a 500.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

40

Security

What is rate limiting in APIs and how do you test it?

Rate limiting caps how many requests a client can make in a time window (e.g. 100/minute) to prevent abuse, protect the server, and keep usage fair.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

41

Environments

How do you manage testing across different environments — dev, staging, and production?

Use environment variables (Postman environments or a config file) to swap base URLs and credentials without touching the test logic.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

42

Practical

How do you write a useful bug report for an API defect?

A good API bug report makes the defect reproducible in one click and unambiguous to triage.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

43

Practical

You accidentally called a DELETE on a real production resource during testing. What do you do?

Act fast, be transparent, then fix the process that allowed it.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

44

Practical

How would you test a file upload API?

File upload spans type validation, size limits, content integrity, and security — the richest negative-testing surface in any API.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

45

Fundamentals

What does it mean for an API to be "stateless" and how does it affect your testing?

Stateless means the server keeps no memory between requests — every request must carry everything it needs to be processed: auth token, session context, all of it.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

46

Practical

How do you test an API endpoint that depends on another call being made first?

You create the prerequisite data yourself in a setup step, capture the ID it returns, and feed that ID into the real test — this is called API chaining.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

47

Testing Concepts

What is the difference between a mock API and the real API, and when do you use a mock?

A real API is the actual running service backed by a real database and real logic — its results are authoritative. A mock API is a fake server that returns canned responses, mimicking the real…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

48

Practical

How do you test that an API returns proper, meaningful error messages?

You trigger each error condition deliberately and verify two things together: the status code is correct *and* the error body is actually useful to whoever receives it.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

49

Fundamentals

What is API versioning and why does it matter for testers?

API versioning is how a team ships breaking changes without breaking the apps already using the old behaviour — by serving the old and new shapes side by side.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

50

Security

You find that an API response is returning sensitive user data it should not be — like passwords or full card numbers. What do you do?

Treat it as a critical security defect, not a normal bug — and handle the evidence carefully so you don't widen the leak while reporting it.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

1

Practical

Walk me through how you would test a brand-new API endpoint.

Start from the contract, then work outward from the happy path into everything that can go wrong — positive, negative, boundary, auth, and side effects.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

2

Validation

Checking the status code isn't enough — how do you validate a response's schema?

You assert against a schema — a definition of which fields must be present, their types, and their formats — instead of trusting that a 200 means the body is correct.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

3

Security

How do you test a token-based authentication flow?

You test the full lifecycle of the token — getting one, using it, and every way it can be rejected — not just the happy "login then call" path.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

4

Practical

How do you test a flow where one request depends on the result of a previous one (request chaining)?

You capture a value from one response and inject it into the next request, so a sequence of calls behaves like a real user journey rather than isolated pokes.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

5

Practical

How do you run the same API test against many inputs (data-driven testing)?

You keep one test that reads its inputs from a data file and runs once per row, rather than copy-pasting the same request for every input combination.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

6

Practical

What negative scenarios do you test for an API?

Negative testing is feeding the API everything it *shouldn't* accept and confirming it refuses cleanly — the right 4xx, a clear message, and no crash or data corruption.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

7

HTTP

Some APIs return 200 OK but include an error inside the body. How do you handle and test that?

You assert on the body, not just the status — the HTTP layer says "OK" but a success: false (or error) field inside the payload is reporting a real failure.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

8

Tools

How do you write automated assertions in Postman?

You write JavaScript in the request's Tests tab using pm.test() and pm.expect(), asserting on status, body fields, schema, headers, and response time.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

9

Tools

What are environments and variables in Postman, and why use them?

Variables hold reusable values (base URL, token, IDs) so they're never hard-coded; environments are named sets of those variables — Dev, Staging, Prod — you switch between so one collection runs anywhere.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

10

Practical

How do you test a paginated API endpoint?

You verify three things: each page honours its size, navigation walks every record exactly once, and the edges (first page, last page, beyond-the-end, bad params) behave sanely.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

11

Practical

How do you test API rate limiting?

You deliberately exceed the allowed request rate and confirm the API throttles you with a 429, tells you when to retry, then lets you back in once the window resets — without ever blocking normal…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

12

REST

What is API versioning, and how do you test across versions?

Versioning (/v1/, /v2/, or a version header) lets an API evolve without breaking existing clients — and the heart of cross-version testing is proving the *old* version still behaves exactly as it did.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

13

Performance

How do you check an API's response time, and what counts as a basic performance check?

You assert the response time stays under an agreed threshold, measured against *realistic* data volumes and repeated for consistency — knowing that timing a single request is a smoke check, not load testing.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

14

HTTP

How do you test that an endpoint is idempotent?

You send the same request more than once and verify the end state is identical to sending it once — no duplicates, no extra side effects, no error on the repeat.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

15

Test Design

Your API depends on another service that isn't ready or is flaky. How do you test around it?

You replace the unready or flaky dependency with a mock/stub that returns canned responses you control, so your API can be tested in isolation and deterministically.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

16

Security

What is CORS, and how can it affect API testing?

CORS (Cross-Origin Resource Sharing) is a *browser* rule deciding which web origins may call an API; it uses a preflight OPTIONS request and Access-Control-Allow-Origin headers.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

17

Practical

How do you test a webhook?

A webhook is a *reverse* API — the server calls your URL when an event happens. You test it by standing up a listener, triggering the event, and verifying the call arrives with the right…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

18

Validation

How do you verify data integrity between an API and the database?

After any write (POST/PUT/DELETE), you confirm the data was *actually persisted correctly* — via a follow-up GET or a direct database query — rather than trusting the success response.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

19

Fundamentals

What is the difference between API testing and integration testing?

API testing checks one API's own behaviour — its contract, responses, status codes, errors. Integration testing checks that multiple components work *together*, often using API calls as the vehicle to verify the end-to-end flow.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

20

Practical

How do you write assertions when the response contains dynamic values (ids, timestamps)?

You assert volatile fields loosely — on type, format, or presence — and reserve exact-match assertions for the stable business fields, while capturing generated values into variables for later steps.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

21

Security

What basic security checks do you run on an API?

You run a baseline checklist covering authentication, authorization, transport, injection, rate limiting, error leakage, and allowed methods — the common ways an API gets breached.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

22

Debugging

An API call returns 500. How do you investigate?

A 500 is a *server-side* fault, so you first rule out a bad request on your side, then move to the server's logs — that's where the real cause lives — and hand devs a…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

23

Practical

How do you test file upload through an API?

File upload uses multipart/form-data, so you test the valid path (uploads and is retrievable), the rejections (wrong type, too big, empty), naming edge cases, and — most importantly — the security of disguised malicious files.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

24

Security

Auth tokens expire midway through a long test run. How do you handle it?

You automate token refresh so the suite never depends on a token staying fresh — a pre-request step fetches or renews the token and stores it in a shared variable — while *separately* testing that…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

25

Debugging

How do you trace a single request across multiple services?

You use a correlation ID — a unique value (often an X-Request-ID header) that's attached to a request and passed through every downstream service and log line, so one request can be traced end to…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

26

Fundamentals

How does testing a GraphQL API differ from testing a REST API?

REST has many endpoints of fixed shape; GraphQL has one endpoint where the client asks for exactly the fields it wants. So your assertions check field-by-field precision, and — critically — errors come back as…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

27

Debugging

Your automated API tests pass locally but fail in CI — how do you debug that?

"Passes locally, fails in CI" almost always means a hidden *environment* difference, not a code difference — so you systematically compare the two environments rather than re-reading the test.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

28

Strategy

A third-party API your product depends on is flaky and sometimes returns errors. What is your testing strategy?

You split the problem in two: mock the third-party so its flakiness can't break your suite or hide your bugs, and separately verify your app's resilience — retries, timeouts, and graceful degradation — when the…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

29

Security

How do you test an OAuth 2.0 authorization code flow end-to-end?

OAuth 2.0 is a multi-step handshake — authorization request, code exchange, token usage — and you test each handoff for both the happy path and tampering, plus scope enforcement at the end.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

30

Maintenance

You have 200 API test cases and maintenance is becoming painful. How do you clean it up?

You treat the test suite like production code that needs refactoring — de-duplicate, extract shared setup, parameterise, tier, and name tests so they read like documentation.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

31

Versioning

A breaking API change is about to be released — how do you handle it in your test suite?

You get the spec diff first, update your tests against the new contract, and — the part people skip — keep the old version's regression suite green so existing consumers aren't broken by the change.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

32

Practical

How do you test idempotency of PUT and DELETE endpoints?

You send the identical PUT or DELETE more than once and assert the *end state* is the same as sending it once — PUT settles on the same value, DELETE removes it once and then…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

33

CI/CD

Your API test suite takes 45 minutes to run in CI. How do you speed it up?

You profile first to find the real bottleneck, then attack it with parallelisation, tiering, and removing waste (fixed sleeps, redundant logins, real third-party calls) — never optimise blindly.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

34

Security

How do you test role-based access control (RBAC) in an API?

You build a role × endpoint matrix and assert the expected outcome for *every* cell — especially the cells where a lower-privileged role must be refused with a 403.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

35

Practical

How do you test webhooks?

Because a webhook is your system calling *out* when an event fires, you test it by becoming the receiver — standing up a listener, triggering the event, and asserting the payload, signature, retries, and duplicate…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

36

Security

How do you handle secrets and credentials securely in your automated API test suite?

You keep secrets out of the test code entirely — injected at runtime from a CI secrets store as environment variables — and apply least privilege, rotation, and no-logging on top.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

37

Practical

How do you validate deeply nested or complex JSON response structures?

You combine two techniques: schema validation for the overall shape, and targeted JSON-path assertions for the specific critical values — and you avoid both extremes of asserting nothing or asserting the entire blob.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

38

Resilience

How do you test how an API behaves when its database is down or unavailable?

You deliberately take the database away — by stopping it in a lower environment or using fault injection — and assert the API fails *cleanly*: a proper 5xx, a safe message, an enforced timeout, no…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

39

Tools

How do you structure your Postman collection for a large API project?

You mirror the API's own structure in folders, lift shared config (base URL, auth) to the collection level, put assertions on every request, and keep it Newman-runnable so the same collection serves humans and CI…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

40

Integration

How do you test APIs that integrate with third-party payment gateways like Stripe?

You test entirely against the provider's sandbox using their published test cards — covering the success path, every decline reason, the 3DS step, and the webhook that actually updates your order — and you never…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

41

Strategy

How do you test backward compatibility when an API changes?

You prove existing clients still work unchanged — ideally with consumer contract tests (Pact) that fail the build on any breaking change, backed by a spec diff and a clear list of what counts as…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

42

Performance

What is the difference between load testing and stress testing an API, and when do you use each?

Load testing confirms the API holds up under *expected* peak traffic; stress testing pushes it *past* its limits to find where and how it breaks. Same tools, opposite questions.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

43

Practical

How do you test a multi-step business flow end-to-end through the API — for example, user registers, verifies email, logs in, and places an order?

You model the journey as a chain where each step feeds its output (IDs, tokens) into the next, and you assert the expected state *at every step* — not just at the end.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

44

Strategy

The API documentation does not match the actual behavior. What do you do?

You don't silently pick a side — you confirm it's a real discrepancy, then get a human (dev or product owner) to declare which is the source of truth, and raise *either* a code bug…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

45

Architecture

How do you test APIs in a microservices architecture without violating test isolation?

You push confidence down the testing pyramid: mock dependencies to test each service in isolation, use contract tests to guarantee the mocks match reality, and reserve real multi-service and full E2E tests for the few…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

46

Security

How do you test for injection attacks in API inputs — SQL injection, command injection, etc.?

You feed crafted attack strings into every input that might reach a query, file system, or shell, and confirm the API treats them as inert data — a clean 400 or sanitised result, never executing…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

47

Performance

How do you test API response time SLAs — for example, the API must respond in under 500ms at p95?

You verify the SLA the way it's written — at a percentile, under load — using a load tool with explicit thresholds, while a lightweight response-time assertion in functional tests catches single-endpoint regressions.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

48

Practical

How do you set up reproducible test environments so API tests give consistent results?

You remove every source of run-to-run variation — config, data, users, external calls, even the clock — so a test's result depends only on the code under test, not on the environment it happened to…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

49

Strategy

How do you ensure your API test cases actually cover the real business requirements, not just the technical contract?

You drive test cases from user stories and business rules, not from the endpoint spec — verifying the *outcome* the business wants, not just that the API returned a valid-looking status code.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

50

Practical

How do you test a data export endpoint that generates large CSV or Excel files?

You test it as a *file*, not just a response: verify the right headers, parse the actual file to check content and encoding, and exercise the large-data failure modes (timeouts, streaming, the async job pattern)…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

1

Test Strategy

How would you build an API testing strategy?

A good API testing strategy starts from risk, not from "test everything" — you decide what to test, at which level, and how deeply, based on what hurts most if it breaks.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

2

Contract Testing

What is contract testing, and why does it matter for microservices?

Contract testing verifies that a provider API and its consumers agree on the request/response shape — without spinning up the whole system for full end-to-end tests.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

3

Strategy

Where should you focus testing — unit, API, or UI?

Follow the test pyramid: many fast unit tests, a strong layer of API/integration tests, and only a few slow UI/E2E tests.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

4

Performance

How do you approach API performance and load testing?

Performance testing measures how an API behaves under load — not just whether it works, but how fast and how reliably it works when many users hit it at once.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

5

Security

How do you approach API security testing?

API security testing checks that the API protects data and access correctly — that users can only do and see what they're authorized to, even when they actively try to break the rules.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

6

Architecture

How do you test APIs in a microservices architecture?

Testing microservices means layering your tests — checking each service on its own, then the agreements between them — rather than leaning on one giant, brittle end-to-end suite.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

7

Test Data

How do you manage test data for API testing at scale?

Test data management at scale is about making sure every test starts from a known, isolated, repeatable state — without leaking real customer data or letting parallel tests trip over each other.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

8

CI/CD

How do you integrate API tests into CI/CD?

Integrating API tests into CI/CD means running the right tests automatically at the right stage — fast checks on every change, heavy suites asynchronously — so quality is enforced without blocking delivery.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

9

Versioning

How do you handle API versioning and backward compatibility in your testing strategy?

Handling versioning in your test strategy means proving that changes don't break existing clients — keeping each supported version under test and classifying every change as breaking or safe.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

10

Test Design

How do you use mocking / service virtualization strategically?

Strategic mocking means replacing the dependencies that are unstable, slow, costly, or not-yet-built with controllable fakes — while keeping a small set of real tests so the fakes don't drift from reality.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

11

Reliability

How do you keep API tests reliable and non-flaky?

Keeping tests non-flaky means eliminating the sources of random, non-code-related failures — so that when a test goes red, it genuinely means something is broken.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

12

Async

How do you test event-driven or asynchronous APIs (queues, Kafka)?

Testing event-driven APIs means verifying a delayed journey — the API accepts the request now, but the real work and its result happen later, so you can't just assert on the immediate response.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

13

Monitoring

How do you monitor APIs in production?

Monitoring APIs in production — "shift-right" testing — means continuously watching the live system so you catch problems in real conditions that no pre-release test environment can fully reproduce.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

14

Regression

How do you keep a large API regression suite maintainable?

Keeping a large regression suite maintainable means treating it as a product you actively curate — pruning, tagging, prioritising, and parallelising — rather than letting it grow into a slow, tangled mass.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

15

Dependencies

How do you handle testing when your API depends on third-party services?

When your API depends on third-party services, the goal is to test your own behaviour reliably — mocking the third party for most tests, while still catching real changes and verifying you survive their failures.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

16

Contract Testing

How do you use an OpenAPI / Swagger spec in your testing?

An OpenAPI/Swagger spec is a machine-readable description of your API, and you use it as the contract — validating that the real implementation matches the documented shape, and generating tests and mocks from it.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

17

Distributed Systems

How do you test retries and idempotency in a distributed system?

Testing retries and idempotency means proving that when a client repeats a request — because the network dropped or timed out — the system produces the same result once, not duplicate side effects.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

18

Resilience

How do you test API resilience (chaos testing)?

Chaos testing means deliberately injecting failure into the system — killing a dependency, dropping the network, spiking latency — to confirm it degrades gracefully instead of collapsing.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

19

Metrics

What metrics tell you about API quality?

The metrics that tell you about API quality are outcome-focused — error rate, latency percentiles, uptime, defect leakage — not activity counts like how many tests you have.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

20

Security

How do you handle secrets (tokens, API keys) in API test automation?

Handling secrets in test automation means keeping tokens and API keys out of your code entirely — injected at runtime from a secure store, scoped narrowly, and scrubbed from logs.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

21

Versioning

How do you manage testing around deprecating or making breaking changes to an API?

Managing a deprecation or breaking change means retiring old API behaviour safely — knowing who depends on it, giving them time and a migration path, and only removing it once usage hits zero.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

22

GraphQL

What is different about testing a GraphQL API at a strategic level?

Testing GraphQL strategically is different because there's one endpoint and the client decides the query shape — so you test query scenarios, field-level access, and complexity limits rather than per-endpoint behaviour.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

23

Architecture

What gateway-level concerns do you test for in an API platform?

Gateway-level testing checks the cross-cutting concerns an API gateway handles — auth, rate limiting, routing, transforms, caching — independently of the backend services behind it.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

24

Strategy

How do you shift API testing left?

Shifting API testing left means moving quality activities earlier — designing and reviewing the contract before any code is written, and testing alongside development rather than after it.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

25

Leadership

You join a team with no API test coverage. How do you start?

Joining a team with no API coverage, you start where risk and value are highest — a small smoke suite of critical endpoints running in CI — and grow outward, rather than trying to test…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

26

Leadership

How do you balance release speed with API test coverage, and when do you push back?

Balancing release speed with coverage means making fast *and* safe possible at once — gating only quick checks, running deeper suites async, and reserving hard pushback for genuinely high-risk changes.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

27

Incident Response

A production API is returning 503 Service Unavailable intermittently. Walk me through your RCA process.

Root-cause analysis for an intermittent 503 means working methodically from symptoms to cause — because "sometimes unavailable" rules out a hard outage and points to something load- or resource-related.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

28

Framework Design

How do you design an API testing framework from scratch for a team of 20 engineers?

Designing an API test framework for 20 engineers is an exercise in adoption and maintainability, not technical elegance — the best framework is the one the whole team actually uses correctly.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

29

Strategy

Your team is migrating from REST to GraphQL. How does your testing approach change?

Migrating from REST to GraphQL changes your testing approach fundamentally — you move from testing fixed endpoints to testing query scenarios, the schema as a contract, and new abuse vectors that REST never had.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

30

Contract Testing

How do you architect consumer-driven contract tests across 15 microservices?

Architecting consumer-driven contract tests across 15 services means letting each consumer declare what it needs and verifying every provider against those declarations in CI — through a central broker — so breaking changes are caught…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

31

Architecture

How do you test an event-driven architecture where services communicate via Kafka or SQS queues?

Testing an event-driven architecture means verifying asynchronous interactions — you publish an event and later observe a side effect — by checking producers, consumers, and the contract of the messages between them.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

32

Security

How do you implement OWASP API Security Top 10 testing in your CI/CD pipeline?

Implementing OWASP API Top 10 testing in CI/CD means spreading the checks across stages — fast assertions in your test suite, automated scans as a gate, and specialist/pen testing on a schedule — rather than…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

33

Strategy

How do you decide what level of API test coverage is "enough"?

Deciding what coverage is "enough" is a question of risk and confidence, not a line-coverage percentage — you tier endpoints by impact and cover each to the depth its risk demands.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

34

Framework Design

How do you build a resilient, self-healing automated API test suite that does not produce false failures?

Building a resilient, false-failure-free suite means engineering out the sources of non-deterministic failure — isolation, unique data, smart retries, quarantine — so a red result always means a real bug.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

35

Security

How do you test a multi-tenant API where one tenant's data must never be visible to another?

Testing a multi-tenant API means proving that one tenant can never reach another tenant's data — systematically attempting cross-tenant access on every endpoint and confirming it's blocked.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

36

Architecture

A service mesh like Istio is introduced to your microservices platform. What changes in your API testing approach?

When a service mesh like Istio is introduced, cross-cutting concerns (TLS, retries, timeouts, circuit breaking, tracing) move out of your application code into the infrastructure — so your testing has to cover that new infrastructure…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

37

Architecture

How do you test API gateway configurations — routing, throttling, request/response transforms, and auth enforcement?

Testing API gateway configuration means verifying each thing the gateway does — routing, auth, throttling, transforms, caching — because the gateway is config-driven infrastructure that can silently break every API behind it.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

38

Architecture

How do you test eventual consistency and data consistency across microservices that do not share a database?

Testing eventual consistency across services that don't share a database means accounting for the time lag — data propagates asynchronously, so you poll for the final state rather than asserting it immediately.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

39

Leadership

A new team of 8 engineers is joining your org and needs to integrate with your existing API test suite. How do you onboard them?

Onboarding a new team onto your test suite means actively guiding them — pairing on real tests, sharing utilities, setting a quality bar — rather than handing over docs and hoping; the onboarding itself doubles…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

40

Leadership

How do you measure and communicate the ROI of API test automation to engineering leadership?

Communicating the ROI of test automation to leadership means translating testing into business outcomes — escape rate, release frequency, cost saved — not test counts they don't care about.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

41

Strategy

How do you handle API versioning strategy from a testing perspective when you have three active versions simultaneously?

Managing testing for three simultaneously-active API versions means keeping a separate, independently-runnable suite per version — while sharing the underlying utilities and pruning aggressively as versions age toward retirement.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

42

Observability

How do you build observability into your API test suite — beyond just pass/fail?

Building observability into a test suite means capturing the *why, how often, and trend* of failures — full request/response, response-time history, failure categories — not just a binary pass/fail.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

43

Architecture

How do you test APIs under geographic distribution — CDN caching, regional failover, and edge deployments?

Testing geographically distributed APIs means covering the failure modes that only appear across regions — CDN caching, regional failover, edge logic, and geo-restrictions — which local, single-region testing can't reveal.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

44

Framework Design

How do you design test data management for a complex microservices system at scale?

Designing test data management for a large microservices system means making every test responsible for its own isolated, namespaced data — generated by factories, cleaned up afterward — so tests stay independent even across many…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

45

Leadership

How do you establish API quality gates for a platform API used by external developers and partners?

Establishing quality gates for a public/partner API means setting progressively stricter checkpoints — every commit, pre-release, and rollout — because you can't hotfix a breaking change once external developers depend on it.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

46

Security

How do you test for race conditions and concurrency issues in APIs?

Testing for race conditions means deliberately firing requests at the exact same moment to expose bugs that only appear under concurrency — then asserting the final state is correct, not just the individual responses.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

47

Strategy

When do you declare an API "not testable" and what do you do about it?

Declaring an API "not testable" means recognising when the conditions for a reliable test can't be established — then documenting the gap as a risk and pushing to make it testable, rather than faking a…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

48

Leadership

How do you build a culture of API quality across multiple engineering teams that are moving at different speeds?

Building a culture of API quality across teams moving at different speeds means using standards, visibility, and enablement — not top-down mandates — so quality becomes the easy default rather than an imposed tax.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

49

Strategy

How do you handle backward-compatible API change testing at the platform level when 50+ internal and external services consume your API?

Handling backward-compatible change testing across 50+ consumers means replacing impossible manual coordination with automated contract verification — every consumer's expectations are checked against every provider build before anything ships.

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →

50

Leadership

How do you integrate DAST (Dynamic Application Security Testing) into your API CI/CD pipeline without slowing down deployments?

Integrating DAST into CI/CD without slowing deployments means stratifying the scans — a fast passive scan on every PR, a full active scan pre-release, deep scans on a schedule — instead of running one slow…

↳ Includes walked-through example, real-world QA scenario & rule of thumb

Get the full answer on QAVeda →