300 API Testing Interview Questions & Answers (2026)

GET retrieves resources without side effects (idempotent); POST creates new resources; PUT replaces entire resources completely; PATCH applies partial updates to existing records; DELETE removes resources.

// GET /users vs POST /users (Create) vs PATCH /users/1 (Update email)

Using RestAssured fluent syntax (`given().when().get().then()`), verify status code `200` and validate JSON schema conformance using `JsonSchemaValidator.matchesJsonSchemaInClasspath()`.

given().header("Auth", token).when().get("/api/v1/user").then().statusCode(200).body("role", equalTo("ADMIN"));

Authenticate against the OAuth token endpoint (`/oauth/token`) before suite execution, extract the `access_token` string from the JSON response, and inject it as a `Bearer` header across all subsequent API test threads.

String token = given().formParam("grant_type", "client_credentials").post("/token").jsonPath().getString("access_token");

Consumer-Driven Contract testing generates JSON contract files defining exact request/response schemas required by frontend consumers. Backend providers run CI verification against these contracts independently, catching breaking API changes before deployment.

{"consumer": {"name": "WebUI"}, "provider": {"name": "OrderAPI"}, "interactions": [...]}

WireMock spins up an embedded HTTP server on an ephemeral port. Engineers define stub mappings (`stubFor(get(urlEqualTo("/ext")).willReturn(aResponse().withStatus(200)))`) to isolate tests from flaky third parties.

stubFor(get(urlEqualTo("/bank/balance")).willReturn(aResponse().withStatus(200).withBody("{\"balance\": 5000}")));

Automating event-driven architectures requires instantiating Kafka consumer listeners inside test helpers that poll topics for emitted message payloads within bounded duration intervals.

ConsumerRecords<String, String> records = consumer.poll(Duration.ofSeconds(10));
Assert.assertFalse(records.isEmpty());

SOAP relies strictly on XML messaging governed by formal WSDL contracts and WS-Security specifications. REST is a lightweight architectural style utilizing HTTP verbs and flexible payloads (JSON, XML).

// REST JSON payloads consume significantly less bandwidth than verbose SOAP XML envelopes

Define Java classes with getter/setter fields. Pass the instantiated POJO directly into RestAssured `body(userObject)`, which automatically uses Jackson ObjectMapper to serialize objects into valid JSON string requests.

UserPojo user = new UserPojo("Alice", "admin@test.com");
given().contentType(ContentType.JSON).body(user).when().post("/users");

Use functional RestAssured test suites to validate complex functional logic during nightly builds, and translate those endpoint flows into Grafana k6 JavaScript virtual user scripts to stress test under 5,000 concurrent RPS.

import http from 'k6/http';
export default function() { http.get('https://api.test.com/health'); }

Isolate environment base URLs in `.properties` files, decouple request builders from assertions, and output JUnit XML reports into GitLab or GitHub CI dashboards to trigger pipeline quality gating.

- name: Publish API Test Results
  uses: EnricoMi/publish-unit-test-result-action@v2

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 11).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 12).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 13).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 14).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 15).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 16).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 17).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 18).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 19).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 20).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 21).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 22).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 23).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 24).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 25).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 26).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 27).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 28).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 29).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 30).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 31).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 32).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 33).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 34).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 35).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 36).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 37).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 38).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 39).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 40).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 41).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 42).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 43).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 44).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 45).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 46).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 47).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 48).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 49).when().get("/records").then().statusCode(200);

When validating enterprise REST endpoints, automation suites must assert that exceeding rate limits returns HTTP 429 Too Many Requests alongside appropriate `Retry-After` headers. For paginated GET endpoints (`?page=2&limit=50`), iteration loops verify page boundary parameters and assert cursor continuity.

given().queryParam("page", 50).when().get("/records").then().statusCode(200);

Validate retrieval by valid ID, invalid ID, nonexistent ID, unauthorized access, response schema, response values, filters, sorting, pagination, and performance for large datasets.

Validate full update, partial update, invalid fields, missing required fields, unauthorized update, concurrent update, version conflict, and whether unchanged fields remain correct.

Validate successful deletion, deletion of nonexistent records, repeated delete request, unauthorized delete, soft delete behavior, dependent resource constraints, and whether deleted records are inaccessible.

Soft delete means a resource is marked as deleted but not physically removed from the database. Testers verify that it no longer appears in normal APIs but may still exist for audit or recovery purposes.

Send create requests with duplicate unique fields like email, username, or order number. The API should return an appropriate error such as 409 Conflict or 422 validation error.

Remove required fields from the payload and verify the API returns a clear validation error. Also test null, empty string, whitespace, and wrong data type where applicable.

Send requests with and without optional fields. Verify default values, null handling, omitted fields, and whether optional values are stored and returned correctly.

Send wrong data types, such as string instead of number or boolean instead of object. The API should reject invalid data with a clear validation response, not fail with 500.

Send special characters, emojis, HTML tags, SQL-like strings, and Unicode values in supported text fields. Verify correct storage, encoding, response display, and security handling. CTA after Q100: Ready to practice these API Testing answers in a real interview format? Try AI Mock Interview → /ai-mock-interview Start Free → /login Related: Selenium interview questions.

Send payloads near and above allowed size limits. Verify accepted maximum size, rejection of oversized requests, response time, and error messages. Large payload testing helps prevent performance and memory issues.

Create or query conditions where no records exist. Verify the API returns an empty array, appropriate metadata, and correct status code. Avoid APIs returning null unexpectedly unless documented.

Test first page, last page, page beyond last, page size zero, maximum page size, negative page number, invalid cursor, and sorting consistency. Pagination defects are common in large datasets. See contract testing.

Prioritize critical business flows, high-risk endpoints, authentication, payment or financial APIs, frequently used endpoints, integration points, and APIs with recent changes. Smoke tests should cover core availability and major workflows.

A good API test case has clear purpose, controlled data, expected status code, schema validation, business validation, negative coverage where needed, and cleanup. It should be repeatable, independent, and easy to debug.

Authentication verifies the identity of the client or user calling the API. Common authentication methods include Basic Auth, Bearer tokens, API keys, OAuth 2.0, JWT, and session cookies. Testers validate valid, invalid, missing, and expired credentials.

Authorization verifies whether an authenticated user has permission to perform an action or access a resource. For example, a normal user may view their own profile but should not access admin APIs.

Authentication answers “Who are you?” while authorization answers “What are you allowed to do?” A user can be authenticated but still forbidden from accessing a resource. This commonly results in 403 Forbidden.

Basic Authentication sends username and password encoded in Base64 in the Authorization header. It should only be used over HTTPS because Base64 is not encryption. Testers validate valid credentials, invalid credentials, and missing credentials.

Bearer Token authentication uses a token in the Authorization header. Example: Authorization: Bearer <token>. Anyone with the token can access protected resources, so tokens must be protected and expired properly.

An API key is a unique key used to identify and authorize an application or client. It may be sent in headers, query parameters, or request body. Header-based API keys are generally preferred over query parameters.

OAuth 2.0 is an authorization framework that allows applications to access resources on behalf of users without sharing passwords. It uses access tokens, refresh tokens, scopes, clients, and authorization flows.

JWT stands for JSON Web Token. It is a compact token format containing claims such as user ID, role, issuer, audience, and expiration. JWTs are commonly used for stateless authentication in APIs.

JWT claims are pieces of information inside the token payload. Common claims include sub, iss, aud, exp, iat, and roles. Testers validate claims for correctness and security.

Token expiry defines how long a token is valid. APIs should reject expired tokens with 401 Unauthorized. Testers validate expired token behavior and refresh token flows.

A refresh token is used to obtain a new access token without asking the user to log in again. It usually has a longer lifetime than an access token and must be stored securely. Reference: OWASP API Security Top 10.