Title: Rest API Design — LearnCoachAssist

Q: What does REST stand for?
A: REST stands for Representational State Transfer, an architectural style for designing scalable web APIs using standard HTTP protocols.

Q: What is a resource in REST API design?
A: A resource is any entity or information that can be named and addressed via a URI, such as a user, order, or document, represented in a format like JSON.

Q: What are the core principles of REST?
A: REST follows principles like client-server separation, statelessness, cacheability, uniform interface, layered system, and optionally code-on-demand.

Q: What does statelessness mean in REST?
A: Statelessness requires that each request from a client contains all necessary information for the server to process it, without relying on server-stored session state.

Q: Why use HTTP methods in REST APIs?
A: HTTP methods define the intended action on a resource: GET for retrieval, POST for creation, PUT for update/replacement, PATCH for partial update, and DELETE for removal.

Q: What is the purpose of a GET request?
A: A GET request retrieves a representation of a resource without modifying it; it must be safe and idempotent.

Q: What is the purpose of a POST request?
A: A POST request creates a new resource or triggers a non-idempotent action; the response often includes the URI of the created resource.

Q: What is the difference between PUT and PATCH?
A: PUT replaces the entire resource with the provided representation (idempotent), while PATCH applies partial modifications to the resource.

Q: When should you use DELETE?
A: DELETE removes a resource; it is idempotent, meaning multiple calls have the same effect as one.

Q: What makes HTTP methods idempotent?
A: Idempotent methods (GET, PUT, DELETE) produce the same result if invoked multiple times without changing the resource beyond the initial application.

Q: What are safe HTTP methods?
A: Safe methods like GET and HEAD do not modify resources; clients can prefetch them without side effects.

Q: How should REST URIs be designed?
A: Use hierarchical, noun-based URIs with plural nouns for collections (e.g., /users), avoid verbs, and leverage query parameters for filtering.

Q: Why use plural nouns in URI paths?
A: Plural nouns (e.g., /users/123) clearly indicate collections and individual items, improving readability and consistency.

Q: What is a proper URI structure for nested resources?
A: Use hierarchies like /users/123/orders/456 for related resources, limiting depth to avoid overly long paths.

Q: When to use query parameters in REST URIs?
A: Query parameters filter, sort, paginate, or search collections (e.g., /users?role=admin&sort=name), keeping paths focused on resources.

Q: What HTTP status code indicates success for GET?
A: 200 OK for successful retrieval; 204 No Content for empty responses like successful DELETE.

Q: What does 201 Created mean?
A: 201 Created is returned after successful resource creation via POST, including the new resource's Location header URI.

Q: When to return 404 Not Found?
A: 404 Not Found indicates the requested resource does not exist on the server.

Q: What is 400 Bad Request used for?
A: 400 Bad Request signals invalid client input, such as malformed syntax or missing required fields.

Q: Explain 429 Too Many Requests.
A: 429 Too Many Requests enforces rate limiting when a client exceeds allowed request frequency.

Q: What response format is standard for REST APIs?
A: JSON is the most common format for requests and responses due to its readability, compactness, and widespread language support.

Q: What is HATEOAS in REST?
A: HATEOAS (Hypermedia as the Engine of Application State) includes links in responses to guide clients to related resources dynamically.

Q: How to implement API versioning?
A: Version via URI prefix (e.g., /v1/users) or Accept header; URI method is simpler but less flexible than headers.

Q: What are advantages of header-based versioning?
A: Header versioning (e.g., Accept: application/vnd.api.v1+json) keeps URIs clean and allows multiple versions without path changes.

Q: What is pagination in REST APIs?
A: Pagination splits large collections into pages using query params like ?page=2&limit=20 to improve performance.

Q: Compare offset-limit vs cursor-based pagination.
A: Offset-limit uses page numbers but inefficient for large datasets; cursor-based uses opaque tokens for efficient, stable forward-only navigation.

Q: How to handle filtering and sorting?
A: Support query params like ?status=active&sort=-created_at for client-controlled filtering and sorting on collections.

Q: What is content negotiation?
A: Content negotiation lets clients specify preferred formats via Accept header (e.g., application/json), allowing servers to respond appropriately.

Q: Why use ETags for caching?
A: ETags are resource version identifiers; clients send If-None-Match to check for changes, enabling efficient conditional requests.

Q: Explain Cache-Control headers.
A: Cache-Control directives like max-age, no-cache control caching behavior, reducing server load and improving response times.

Q: What is API authentication?
A: Authentication verifies client identity using methods like API keys, Basic Auth, OAuth, or JWT tokens.

Q: What are API keys and their limitations?
A: API keys are simple shared secrets in headers (e.g., X-API-Key); easy but insecure if exposed, lacking fine-grained scopes.

Q: How does OAuth 2.0 work in REST APIs?
A: OAuth 2.0 uses access tokens issued by an authorization server for delegated access, supporting scopes and refresh tokens.

Q: What is JWT and its role in APIs?
A: JWT (JSON Web Token) is a compact, self-contained token for stateless authentication, carrying claims like user ID and expiration.

Q: What is rate limiting?
A: Rate limiting restricts request volume per client (e.g., 1000/hour) to prevent abuse, using headers like X-RateLimit-Remaining.

Q: How to design error responses?
A: Use consistent JSON structures with status code, title, detail, and instance per RFC 7807 (Problem Details) for machine-readable errors.

Q: What is CORS and why needed?
A: CORS (Cross-Origin Resource Sharing) headers allow browser-based clients from different origins to access APIs securely.

Q: Explain idempotency keys.
A: Clients send unique idempotency keys in POST/PUT to ensure operations like payments are processed only once, even on retries.

Q: What are conditional requests?
A: Conditional requests use headers like If-Match (ETag) or If-Modified-Since to avoid unnecessary data transfer if unchanged.

Q: How to support bulk operations?
A: Batch endpoints like POST /users/batch with an array of operations, returning per-item results and errors.

Q: What is partial response optimization?
A: Use fields query param (e.g., ?fields=name,email) to return only requested fields, reducing bandwidth.

Q: Describe async API patterns.
A: For long-running tasks, return 202 Accepted with a status URI (e.g., /tasks/123) polled via GET for completion.

Q: What is the uniform interface constraint?
A: Uniform interface standardizes identification (URIs), manipulation (methods), message format (JSON), and hypermedia (HATEOAS).

Q: Why avoid verbs in URIs?
A: Verbs duplicate HTTP methods (e.g., use DELETE /users/1 not /delete/user/1); focus on nouns for resources.

Q: What status for validation errors?
A: 422 Unprocessable Entity for semantic validation failures, like invalid email format, distinct from 400 syntax errors.

Q: How to secure REST APIs?
A: Use HTTPS, validate inputs, authorize via scopes, rate limit, and follow OWASP guidelines to prevent common vulnerabilities.

Q: What is client-server constraint?
A: Separates concerns: servers manage resources, clients handle UI; enables independent evolution and scalability.

Q: Explain layered system in REST.
A: Layered system allows intermediaries like load balancers or caches without client awareness, promoting scalability.

Q: When to use OPTIONS method?
A: OPTIONS preflights CORS or returns allowed methods/headers for a resource (Allow header).

Q: What advanced pattern is request bundling?
A: Bundling combines multiple related requests into one (e.g., POST /batch) to reduce round-trips and latency.