Rest API Design Practice Exam

Question 1 Rest API Design

What is API authentication?

Idempotent methods (GET, PUT, DELETE) produce the same result if invoked multiple times without changing the resource beyond the initial application. A GET request retrieves a representation of a resource without modifying it; it must be safe and idempotent. Authentication verifies client identity using methods like API keys, Basic Auth, OAuth, or JWT tokens. Cache-Control directives like max-age, no-cache control caching behavior, reducing server load and improving response times.

Question 2 Rest API Design

What is content negotiation?

429 Too Many Requests enforces rate limiting when a client exceeds allowed request frequency. 400 Bad Request signals invalid client input, such as malformed syntax or missing required fields. Clients send unique idempotency keys in POST/PUT to ensure operations like payments are processed only once, even on retries. Content negotiation lets clients specify preferred formats via Accept header (e.g., application/json), allowing servers to respond appropriately.

Question 3 Rest API Design

When should you use DELETE?

Version via URI prefix (e.g., /v1/users) or Accept header; URI method is simpler but less flexible than headers. Idempotent methods (GET, PUT, DELETE) produce the same result if invoked multiple times without changing the resource beyond the initial application. DELETE removes a resource; it is idempotent, meaning multiple calls have the same effect as one. Use consistent JSON structures with status code, title, detail, and instance per RFC 7807 (Problem Details) for machine-readable errors.

Question 4 Rest API Design

What status for validation errors?

Support query params like ?status=active&sort=-created_at for client-controlled filtering and sorting on collections. Offset-limit uses page numbers but inefficient for large datasets; cursor-based uses opaque tokens for efficient, stable forward-only navigation. Version via URI prefix (e.g., /v1/users) or Accept header; URI method is simpler but less flexible than headers. 422 Unprocessable Entity for semantic validation failures, like invalid email format, distinct from 400 syntax errors.

Question 5 Rest API Design

What HTTP status code indicates success for GET?

Conditional requests use headers like If-Match (ETag) or If-Modified-Since to avoid unnecessary data transfer if unchanged. API keys are simple shared secrets in headers (e.g., X-API-Key); easy but insecure if exposed, lacking fine-grained scopes. 200 OK for successful retrieval; 204 No Content for empty responses like successful DELETE. 400 Bad Request signals invalid client input, such as malformed syntax or missing required fields.

Question 6 Rest API Design

What is rate limiting?

Rate limiting restricts request volume per client (e.g., 1000/hour) to prevent abuse, using headers like X-RateLimit-Remaining. A GET request retrieves a representation of a resource without modifying it; it must be safe and idempotent. CORS (Cross-Origin Resource Sharing) headers allow browser-based clients from different origins to access APIs securely. A POST request creates a new resource or triggers a non-idempotent action; the response often includes the URI of the created resource.

Question 7 Rest API Design

Explain idempotency keys.

Layered system allows intermediaries like load balancers or caches without client awareness, promoting scalability. Clients send unique idempotency keys in POST/PUT to ensure operations like payments are processed only once, even on retries. Query parameters filter, sort, paginate, or search collections (e.g., /users?role=admin&sort=name), keeping paths focused on resources. JWT (JSON Web Token) is a compact, self-contained token for stateless authentication, carrying claims like user ID and expiration.

Question 8 Rest API Design

How to support bulk operations?

201 Created is returned after successful resource creation via POST, including the new resource's Location header URI. Use fields query param (e.g., ?fields=name,email) to return only requested fields, reducing bandwidth. Batch endpoints like POST /users/batch with an array of operations, returning per-item results and errors. Uniform interface standardizes identification (URIs), manipulation (methods), message format (JSON), and hypermedia (HATEOAS).

Question 9 Rest API Design

What is the purpose of a GET request?

200 OK for successful retrieval; 204 No Content for empty responses like successful DELETE. Authentication verifies client identity using methods like API keys, Basic Auth, OAuth, or JWT tokens. A GET request retrieves a representation of a resource without modifying it; it must be safe and idempotent. DELETE removes a resource; it is idempotent, meaning multiple calls have the same effect as one.

Question 10 Rest API Design

What does statelessness mean in REST?

Uniform interface standardizes identification (URIs), manipulation (methods), message format (JSON), and hypermedia (HATEOAS). Statelessness requires that each request from a client contains all necessary information for the server to process it, without relying on server-stored session state. Support query params like ?status=active&sort=-created_at for client-controlled filtering and sorting on collections. HATEOAS (Hypermedia as the Engine of Application State) includes links in responses to guide clients to related resources dynamically.

Question 11 Rest API Design

What is JWT and its role in APIs?

Conditional requests use headers like If-Match (ETag) or If-Modified-Since to avoid unnecessary data transfer if unchanged. Plural nouns (e.g., /users/123) clearly indicate collections and individual items, improving readability and consistency. JWT (JSON Web Token) is a compact, self-contained token for stateless authentication, carrying claims like user ID and expiration. Use hierarchies like /users/123/orders/456 for related resources, limiting depth to avoid overly long paths.

Question 12 Rest API Design

When to use query parameters in REST URIs?

Idempotent methods (GET, PUT, DELETE) produce the same result if invoked multiple times without changing the resource beyond the initial application. Query parameters filter, sort, paginate, or search collections (e.g., /users?role=admin&sort=name), keeping paths focused on resources. A GET request retrieves a representation of a resource without modifying it; it must be safe and idempotent. Layered system allows intermediaries like load balancers or caches without client awareness, promoting scalability.

Question 13 Rest API Design

How does OAuth 2.0 work in REST APIs?

Verbs duplicate HTTP methods (e.g., use DELETE /users/1 not /delete/user/1); focus on nouns for resources. ETags are resource version identifiers; clients send If-None-Match to check for changes, enabling efficient conditional requests. OAuth 2.0 uses access tokens issued by an authorization server for delegated access, supporting scopes and refresh tokens. Conditional requests use headers like If-Match (ETag) or If-Modified-Since to avoid unnecessary data transfer if unchanged.

Question 14 Rest API Design

What is the purpose of a POST request?

A POST request creates a new resource or triggers a non-idempotent action; the response often includes the URI of the created resource. PUT replaces the entire resource with the provided representation (idempotent), while PATCH applies partial modifications to the resource. A GET request retrieves a representation of a resource without modifying it; it must be safe and idempotent. Use HTTPS, validate inputs, authorize via scopes, rate limit, and follow OWASP guidelines to prevent common vulnerabilities.

Question 15 Rest API Design

Why use plural nouns in URI paths?

Plural nouns (e.g., /users/123) clearly indicate collections and individual items, improving readability and consistency. A resource is any entity or information that can be named and addressed via a URI, such as a user, order, or document, represented in a format like JSON. Version via URI prefix (e.g., /v1/users) or Accept header; URI method is simpler but less flexible than headers. Use consistent JSON structures with status code, title, detail, and instance per RFC 7807 (Problem Details) for machine-readable errors.

Question 16 Rest API Design

What are the core principles of REST?

REST follows principles like client-server separation, statelessness, cacheability, uniform interface, layered system, and optionally code-on-demand. Version via URI prefix (e.g., /v1/users) or Accept header; URI method is simpler but less flexible than headers. Query parameters filter, sort, paginate, or search collections (e.g., /users?role=admin&sort=name), keeping paths focused on resources. PUT replaces the entire resource with the provided representation (idempotent), while PATCH applies partial modifications to the resource.

Question 17 Rest API Design

What is a resource in REST API design?

A resource is any entity or information that can be named and addressed via a URI, such as a user, order, or document, represented in a format like JSON. Safe methods like GET and HEAD do not modify resources; clients can prefetch them without side effects. Use fields query param (e.g., ?fields=name,email) to return only requested fields, reducing bandwidth. Use HTTPS, validate inputs, authorize via scopes, rate limit, and follow OWASP guidelines to prevent common vulnerabilities.

Question 18 Rest API Design

How to design error responses?

DELETE removes a resource; it is idempotent, meaning multiple calls have the same effect as one. Authentication verifies client identity using methods like API keys, Basic Auth, OAuth, or JWT tokens. HATEOAS (Hypermedia as the Engine of Application State) includes links in responses to guide clients to related resources dynamically. Use consistent JSON structures with status code, title, detail, and instance per RFC 7807 (Problem Details) for machine-readable errors.

Question 19 Rest API Design

What are advantages of header-based versioning?

429 Too Many Requests enforces rate limiting when a client exceeds allowed request frequency. Header versioning (e.g., Accept: application/vnd.api.v1+json) keeps URIs clean and allows multiple versions without path changes. Use hierarchies like /users/123/orders/456 for related resources, limiting depth to avoid overly long paths. REST stands for Representational State Transfer, an architectural style for designing scalable web APIs using standard HTTP protocols.

Question 20 Rest API Design

Why avoid verbs in URIs?

OPTIONS preflights CORS or returns allowed methods/headers for a resource (Allow header). REST stands for Representational State Transfer, an architectural style for designing scalable web APIs using standard HTTP protocols. Rate limiting restricts request volume per client (e.g., 1000/hour) to prevent abuse, using headers like X-RateLimit-Remaining. Verbs duplicate HTTP methods (e.g., use DELETE /users/1 not /delete/user/1); focus on nouns for resources.

Question 21 Rest API Design

What is 400 Bad Request used for?

404 Not Found indicates the requested resource does not exist on the server. Pagination splits large collections into pages using query params like ?page=2&limit=20 to improve performance. PUT replaces the entire resource with the provided representation (idempotent), while PATCH applies partial modifications to the resource. 400 Bad Request signals invalid client input, such as malformed syntax or missing required fields.

Question 22 Rest API Design

What are safe HTTP methods?

ETags are resource version identifiers; clients send If-None-Match to check for changes, enabling efficient conditional requests. Safe methods like GET and HEAD do not modify resources; clients can prefetch them without side effects. 201 Created is returned after successful resource creation via POST, including the new resource's Location header URI. Conditional requests use headers like If-Match (ETag) or If-Modified-Since to avoid unnecessary data transfer if unchanged.

Question 23 Rest API Design

Describe async API patterns.

Conditional requests use headers like If-Match (ETag) or If-Modified-Since to avoid unnecessary data transfer if unchanged. PUT replaces the entire resource with the provided representation (idempotent), while PATCH applies partial modifications to the resource. Support query params like ?status=active&sort=-created_at for client-controlled filtering and sorting on collections. For long-running tasks, return 202 Accepted with a status URI (e.g., /tasks/123) polled via GET for completion.

Question 24 Rest API Design

What is client-server constraint?

Version via URI prefix (e.g., /v1/users) or Accept header; URI method is simpler but less flexible than headers. Separates concerns: servers manage resources, clients handle UI; enables independent evolution and scalability. 200 OK for successful retrieval; 204 No Content for empty responses like successful DELETE. REST follows principles like client-server separation, statelessness, cacheability, uniform interface, layered system, and optionally code-on-demand.

Question 25 Rest API Design

What are API keys and their limitations?

Support query params like ?status=active&sort=-created_at for client-controlled filtering and sorting on collections. 404 Not Found indicates the requested resource does not exist on the server. API keys are simple shared secrets in headers (e.g., X-API-Key); easy but insecure if exposed, lacking fine-grained scopes. Batch endpoints like POST /users/batch with an array of operations, returning per-item results and errors.

Question 26 Rest API Design

Why use ETags for caching?

422 Unprocessable Entity for semantic validation failures, like invalid email format, distinct from 400 syntax errors. PUT replaces the entire resource with the provided representation (idempotent), while PATCH applies partial modifications to the resource. ETags are resource version identifiers; clients send If-None-Match to check for changes, enabling efficient conditional requests. HATEOAS (Hypermedia as the Engine of Application State) includes links in responses to guide clients to related resources dynamically.

Question 27 Rest API Design

When to return 404 Not Found?

Cache-Control directives like max-age, no-cache control caching behavior, reducing server load and improving response times. 404 Not Found indicates the requested resource does not exist on the server. Separates concerns: servers manage resources, clients handle UI; enables independent evolution and scalability. JSON is the most common format for requests and responses due to its readability, compactness, and widespread language support.

Question 28 Rest API Design

What advanced pattern is request bundling?

Rate limiting restricts request volume per client (e.g., 1000/hour) to prevent abuse, using headers like X-RateLimit-Remaining. Bundling combines multiple related requests into one (e.g., POST /batch) to reduce round-trips and latency. HATEOAS (Hypermedia as the Engine of Application State) includes links in responses to guide clients to related resources dynamically. Idempotent methods (GET, PUT, DELETE) produce the same result if invoked multiple times without changing the resource beyond the initial application.

Question 29 Rest API Design

What is the uniform interface constraint?

Uniform interface standardizes identification (URIs), manipulation (methods), message format (JSON), and hypermedia (HATEOAS). Rate limiting restricts request volume per client (e.g., 1000/hour) to prevent abuse, using headers like X-RateLimit-Remaining. CORS (Cross-Origin Resource Sharing) headers allow browser-based clients from different origins to access APIs securely. 400 Bad Request signals invalid client input, such as malformed syntax or missing required fields.

Question 30 Rest API Design

Explain layered system in REST.

Use hierarchies like /users/123/orders/456 for related resources, limiting depth to avoid overly long paths. ETags are resource version identifiers; clients send If-None-Match to check for changes, enabling efficient conditional requests. REST stands for Representational State Transfer, an architectural style for designing scalable web APIs using standard HTTP protocols. Layered system allows intermediaries like load balancers or caches without client awareness, promoting scalability.

Question 31 Rest API Design

What does REST stand for?

Pagination splits large collections into pages using query params like ?page=2&limit=20 to improve performance. Use consistent JSON structures with status code, title, detail, and instance per RFC 7807 (Problem Details) for machine-readable errors. REST stands for Representational State Transfer, an architectural style for designing scalable web APIs using standard HTTP protocols. Authentication verifies client identity using methods like API keys, Basic Auth, OAuth, or JWT tokens.

Question 32 Rest API Design

What does 201 Created mean?

OAuth 2.0 uses access tokens issued by an authorization server for delegated access, supporting scopes and refresh tokens. 201 Created is returned after successful resource creation via POST, including the new resource's Location header URI. 400 Bad Request signals invalid client input, such as malformed syntax or missing required fields. Support query params like ?status=active&sort=-created_at for client-controlled filtering and sorting on collections.

Question 33 Rest API Design

How to handle filtering and sorting?

Authentication verifies client identity using methods like API keys, Basic Auth, OAuth, or JWT tokens. Support query params like ?status=active&sort=-created_at for client-controlled filtering and sorting on collections. Batch endpoints like POST /users/batch with an array of operations, returning per-item results and errors. Clients send unique idempotency keys in POST/PUT to ensure operations like payments are processed only once, even on retries.

Question 34 Rest API Design

What is HATEOAS in REST?

HTTP methods define the intended action on a resource: GET for retrieval, POST for creation, PUT for update/replacement, PATCH for partial update, and DELETE for removal. HATEOAS (Hypermedia as the Engine of Application State) includes links in responses to guide clients to related resources dynamically. 429 Too Many Requests enforces rate limiting when a client exceeds allowed request frequency. 200 OK for successful retrieval; 204 No Content for empty responses like successful DELETE.

Question 35 Rest API Design

What is the difference between PUT and PATCH?

Use consistent JSON structures with status code, title, detail, and instance per RFC 7807 (Problem Details) for machine-readable errors. ETags are resource version identifiers; clients send If-None-Match to check for changes, enabling efficient conditional requests. Bundling combines multiple related requests into one (e.g., POST /batch) to reduce round-trips and latency. PUT replaces the entire resource with the provided representation (idempotent), while PATCH applies partial modifications to the resource.

Question 36 Rest API Design

What is a proper URI structure for nested resources?

Use hierarchies like /users/123/orders/456 for related resources, limiting depth to avoid overly long paths. 200 OK for successful retrieval; 204 No Content for empty responses like successful DELETE. A resource is any entity or information that can be named and addressed via a URI, such as a user, order, or document, represented in a format like JSON. Cache-Control directives like max-age, no-cache control caching behavior, reducing server load and improving response times.

Question 37 Rest API Design

What makes HTTP methods idempotent?

A GET request retrieves a representation of a resource without modifying it; it must be safe and idempotent. OAuth 2.0 uses access tokens issued by an authorization server for delegated access, supporting scopes and refresh tokens. A POST request creates a new resource or triggers a non-idempotent action; the response often includes the URI of the created resource. Idempotent methods (GET, PUT, DELETE) produce the same result if invoked multiple times without changing the resource beyond the initial application.

Question 38 Rest API Design

When to use OPTIONS method?

OPTIONS preflights CORS or returns allowed methods/headers for a resource (Allow header). Query parameters filter, sort, paginate, or search collections (e.g., /users?role=admin&sort=name), keeping paths focused on resources. Plural nouns (e.g., /users/123) clearly indicate collections and individual items, improving readability and consistency. 200 OK for successful retrieval; 204 No Content for empty responses like successful DELETE.

Question 39 Rest API Design

What response format is standard for REST APIs?

Use consistent JSON structures with status code, title, detail, and instance per RFC 7807 (Problem Details) for machine-readable errors. Cache-Control directives like max-age, no-cache control caching behavior, reducing server load and improving response times. JSON is the most common format for requests and responses due to its readability, compactness, and widespread language support. REST follows principles like client-server separation, statelessness, cacheability, uniform interface, layered system, and optionally code-on-demand.

Question 40 Rest API Design

What are conditional requests?

Plural nouns (e.g., /users/123) clearly indicate collections and individual items, improving readability and consistency. Verbs duplicate HTTP methods (e.g., use DELETE /users/1 not /delete/user/1); focus on nouns for resources. Conditional requests use headers like If-Match (ETag) or If-Modified-Since to avoid unnecessary data transfer if unchanged. Idempotent methods (GET, PUT, DELETE) produce the same result if invoked multiple times without changing the resource beyond the initial application.

Question 41 Rest API Design

What is pagination in REST APIs?

Pagination splits large collections into pages using query params like ?page=2&limit=20 to improve performance. 201 Created is returned after successful resource creation via POST, including the new resource's Location header URI. 422 Unprocessable Entity for semantic validation failures, like invalid email format, distinct from 400 syntax errors. PUT replaces the entire resource with the provided representation (idempotent), while PATCH applies partial modifications to the resource.

Question 42 Rest API Design

How should REST URIs be designed?

Query parameters filter, sort, paginate, or search collections (e.g., /users?role=admin&sort=name), keeping paths focused on resources. For long-running tasks, return 202 Accepted with a status URI (e.g., /tasks/123) polled via GET for completion. Use hierarchies like /users/123/orders/456 for related resources, limiting depth to avoid overly long paths. Use hierarchical, noun-based URIs with plural nouns for collections (e.g., /users), avoid verbs, and leverage query parameters for filtering.

Question 43 Rest API Design

Explain 429 Too Many Requests.

429 Too Many Requests enforces rate limiting when a client exceeds allowed request frequency. Rate limiting restricts request volume per client (e.g., 1000/hour) to prevent abuse, using headers like X-RateLimit-Remaining. A resource is any entity or information that can be named and addressed via a URI, such as a user, order, or document, represented in a format like JSON. CORS (Cross-Origin Resource Sharing) headers allow browser-based clients from different origins to access APIs securely.

Question 44 Rest API Design

How to implement API versioning?

Header versioning (e.g., Accept: application/vnd.api.v1+json) keeps URIs clean and allows multiple versions without path changes. JWT (JSON Web Token) is a compact, self-contained token for stateless authentication, carrying claims like user ID and expiration. PUT replaces the entire resource with the provided representation (idempotent), while PATCH applies partial modifications to the resource. Version via URI prefix (e.g., /v1/users) or Accept header; URI method is simpler but less flexible than headers.

Question 45 Rest API Design

Explain Cache-Control headers.

Rate limiting restricts request volume per client (e.g., 1000/hour) to prevent abuse, using headers like X-RateLimit-Remaining. Cache-Control directives like max-age, no-cache control caching behavior, reducing server load and improving response times. 422 Unprocessable Entity for semantic validation failures, like invalid email format, distinct from 400 syntax errors. Safe methods like GET and HEAD do not modify resources; clients can prefetch them without side effects.

Question 46 Rest API Design

How to secure REST APIs?

OPTIONS preflights CORS or returns allowed methods/headers for a resource (Allow header). Use HTTPS, validate inputs, authorize via scopes, rate limit, and follow OWASP guidelines to prevent common vulnerabilities. PUT replaces the entire resource with the provided representation (idempotent), while PATCH applies partial modifications to the resource. Conditional requests use headers like If-Match (ETag) or If-Modified-Since to avoid unnecessary data transfer if unchanged.

Question 47 Rest API Design

Why use HTTP methods in REST APIs?

HTTP methods define the intended action on a resource: GET for retrieval, POST for creation, PUT for update/replacement, PATCH for partial update, and DELETE for removal. Separates concerns: servers manage resources, clients handle UI; enables independent evolution and scalability. 400 Bad Request signals invalid client input, such as malformed syntax or missing required fields. 429 Too Many Requests enforces rate limiting when a client exceeds allowed request frequency.

Question 48 Rest API Design

What is partial response optimization?

Statelessness requires that each request from a client contains all necessary information for the server to process it, without relying on server-stored session state. Use fields query param (e.g., ?fields=name,email) to return only requested fields, reducing bandwidth. DELETE removes a resource; it is idempotent, meaning multiple calls have the same effect as one. Idempotent methods (GET, PUT, DELETE) produce the same result if invoked multiple times without changing the resource beyond the initial application.

Question 49 Rest API Design

What is CORS and why needed?

CORS (Cross-Origin Resource Sharing) headers allow browser-based clients from different origins to access APIs securely. 404 Not Found indicates the requested resource does not exist on the server. DELETE removes a resource; it is idempotent, meaning multiple calls have the same effect as one. 201 Created is returned after successful resource creation via POST, including the new resource's Location header URI.

Question 50 Rest API Design

Compare offset-limit vs cursor-based pagination.

Use HTTPS, validate inputs, authorize via scopes, rate limit, and follow OWASP guidelines to prevent common vulnerabilities. Offset-limit uses page numbers but inefficient for large datasets; cursor-based uses opaque tokens for efficient, stable forward-only navigation. REST follows principles like client-server separation, statelessness, cacheability, uniform interface, layered system, and optionally code-on-demand. Query parameters filter, sort, paginate, or search collections (e.g., /users?role=admin&sort=name), keeping paths focused on resources.