Common Implementation & Solution Consultant/Pre-sales interview API questions

Implementation & Solutioning/Pre-sales consultant interviews

1. What is an API?

An API (Application Programming Interface) is a set of rules and protocols that allows different software applications to communicate with each other. It defines the methods and data formats applications can use to request and exchange information.

Real-world analogy: Like a waiter in a restaurant, you (client) give your order to the waiter (API), who takes it to the kitchen (server), and brings back your food (response).

2. What is REST API?

REST (Representational State Transfer) is an architectural style for designing networked applications. It uses HTTP requests to perform CRUD operations.

Key principles:

• Stateless: Each request contains all information needed
• Client-Server: Separation of concerns
• Cacheable: Responses can be cached
• Uniform Interface: Consistent way to interact
• Layered System: Client doesn’t know if connected directly to server

Example:

GET /users          → Get all users
GET /users/123      → Get user with ID 123
POST /users         → Create new user
PUT /users/123      → Update user 123
DELETE /users/123   → Delete user 123

3. HTTP Methods (Verbs)

*Idempotent: Same result if called multiple times

**Safe: Doesn’t modify data

4. HTTP Status Codes

Common categories:

2xx - Success

• 200 OK: Request succeeded
• 201 Created: Resource created successfully
• 204 No Content: Success but no data to return

3xx - Redirection

• 301 Moved Permanently: Resource has new URL
• 302 Found: Temporary redirect
• 304 Not Modified: Cached version is still valid

4xx - Client Errors

• 400 Bad Request: Invalid request format
• 401 Unauthorized: Authentication required
• 403 Forbidden: Authenticated but not allowed
• 404 Not Found: Resource doesn't exist
• 429 Too Many Requests: Rate limit exceeded

5xx - Server Errors

• 500 Internal Server Error: Server crashed
• 502 Bad Gateway: Invalid response from upstream
• 503 Service Unavailable: Server overloaded/down
• 504 Gateway Timeout: Upstream server timeout

5. What’s the difference between PUT and PATCH?

PUT: Replace the entire resource

PUT /users/123
{
  "name": "John Doe",
  "email": "john@example.com",
  "age": 30,
  "city": "New York"
}
// Must send ALL fields

PATCH: Update only specific fields

PATCH /users/123
{
  "email": "newemail@example.com"
}
// Send only changed fields

6. What is API Authentication vs Authorization?

Authentication: Who are you?
- Verifying identity (login credentials, tokens)
- "Are you really John Doe?"

Authorization: What can you do?
- Checking permissions
- "Can John Doe access this admin panel?"

Common methods:

Basic Auth:
Authorization: Basic base64(username:password)

Bearer Token (JWT):
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

API Key:
X-API-Key: abc123xyz789

OAuth 2.0: Token-based authorization framework

7. What is an API endpoint?

Answer: A specific URL where an API can access resources.

Examples:
https://api.example.com/users ← Endpoint
https://api.example.com/users/123 ← Endpoint
https://api.example.com/users/123/orders ← Endpoint
Base URL: https://api.example.com Resource path: /users/123/orders

8. What is JSON? Why is it used in APIs?

Answer: JSON (JavaScript Object Notation) is a lightweight data format for exchanging information.

Why use it?

• Human-readable
• Easy to parse
• Language-independent
• Smaller than XML
• Native JavaScript support

Example:

{
  "userId": 123,
  "name": "John Doe",
  "email": "john@example.com",
  "isActive": true,
  "roles": ["admin", "user"],
  "metadata": {
    "lastLogin": "2024-01-14T10:30:00Z"
  }
}
```

9. What is API Rate Limiting?

Answer: Restricting the number of API requests a client can make in a given time period.

Get Anushi Singh’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Example:
- 100 requests per hour per user
- 1000 requests per day per API key

Response when limit exceeded:
Status: 429 Too Many Requests
Headers:
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1642156800
Retry-After: 3600

Why it's needed:
- Prevent abuse
- Ensure fair usage
- Protect server resources
- Prevent DDoS attacks

10. What is CORS?

Cross-Origin Resource Sharing - a security feature that controls how web pages from one domain can access resources from another domain.

The Problem:
Your website: https://myapp.com
API server: https://api.example.com

Browser blocks requests by default (security)

Solution - CORS Headers:
Access-Control-Allow-Origin: https://myapp.com
Access-Control-Allow-Methods: GET, POST, PUT
Access-Control-Allow-Headers: Content-Type, Authorization

Common error:
Access to fetch at 'https://api.example.com/users' from origin
'https://myapp.com' has been blocked by CORS policy

11. What's the difference between REST and SOAP?

12. What is Pagination in APIs?

Breaking large datasets into smaller chunks (pages).

Methods:

Offset-based:
GET /users?limit=10&offset=20
// Skip 20, get next 10

Page-based:
GET /users?page=3&per_page=10
// Get page 3, 10 items per page

Cursor-based (better for large datasets):
GET /users?cursor=eyJpZCI6MTIzfQ&limit=10

Response includes:

{
  "data": [...],
  "pagination": {
    "total": 1000,
    "page": 3,
    "per_page": 10,
    "total_pages": 100
  }
}

13. What is API Versioning?

Managing different versions of an API to avoid breaking existing clients when making changes.

Methods:

URI Versioning(most common):
https://api.example.com/v1/users
https://api.example.com/v2/users

Header Versioning:
GET /users
Accept: application/vnd.example.v1+json

Query Parameter:
GET /users?version=1

14. What are API Headers?

Metadata sent with HTTP requests and responses.

Common Request Headers:

Content-Type: application/json
Authorization: Bearer token123
Accept: application/json
User-Agent: MyApp/1.0
Cache-Control: no-cache

Common Response Headers:

Content-Type: application/json
Content-Length: 1234
Cache-Control: max-age=3600
ETag: "33a64df551425fcc55e4d42a148795d9f25f89d4"

15. What is the difference between Synchronous and Asynchronous APIs?

Synchronous:
- Client waits for response
- Blocking operation
- Simple but can be slow
Request → [Wait] → Response → Continue

Asynchronous:
- Client doesn't wait
- Non-blocking
- Better for long operations
Request → Task ID returned immediately
↓
Poll for status or receive webhook callback later

Example (Async):

POST /process-large-file
Response: { "jobId": "abc123", "status": "processing" }

GET /jobs/abc123
Response: { "jobId": "abc123", "status": "completed", "result": {...} }

16. How do you test an API?

Functional Testing:
- Verify correct response for valid input
- Test error handling for invalid input
- Check all HTTP methods work correctly
- Validate response structure (JSON schema)

Performance Testing:
- Response time under normal load
- Behavior under high load
- Rate limiting works correctly

Security Testing:
- Authentication required
- Authorization enforced
- Input validation
- SQL injection prevention
- HTTPS enforced

Tools: Postman, cURL, JMeter, REST Assured

17. What would you check when an API is slow?

1. Network latency: Use ping, traceroute
2. Response time breakdown: DNS, connection, server processing, data transfer
3. Database queries: Slow queries, missing indexes
4. Payload size: Large responses, compression needed
5. Server resources: CPU, memory, connections
6. External dependencies: Third-party APIs timing out
7. Caching: Not utilizing cache properly

Tools: Browser DevTools, Postman, server logs, APM tools

18. What is idempotency and why does it matter?

An idempotent operation produces the same result no matter how many times it's executed.

Idempotent methods: GET, PUT, DELETE
Non-idempotent: POST

Example:

PUT /users/123 { "name": "John" }
// Call 1: Updates name to John
// Call 2: Updates name to John (same result)
// Call 100: Still John (same result)

POST /orders
// Call 1: Creates order #1001
// Call 2: Creates order #1002 (different result!)

Why it matters: Network issues, retries won’t cause duplicate actions with idempotent APIs

19. What is API Documentation and why is it important?

Answer: Comprehensive guide explaining how to use an API.

Should include:

• Base URL
• Authentication method
• All endpoints
• Request/response examples
• Error codes
• Rate limits
• Code samples in multiple languages

Tools: Swagger/OpenAPI, Postman Collections, API Blueprint

20. What’s the difference between API and Web Service?

API: General interface for application communication (can be web-based or not)

Web Service: Specifically uses web protocols (HTTP/HTTPS) to communicate

All web services are APIs, but not all APIs are web services

Example: Database API (not a web service), REST API (is a web service)