Home/Interview Prep/REST API Design

REST API Design Interview Questions

Resource modelling, method and status code semantics, versioning and deprecation, pagination, error contracts, auth, and caching — design judgement rather than protocol trivia.

ResourcesVersioningPaginationErrorsAuthAria-powered explanations
0 / 100 answered
0%
6 Easy63 Medium31 Hard

Showing 1–20 of 100

#1What actually makes an API RESTful?

Medium
Fundamentals

#2What does statelessness mean in practice, and what does it rule out?

Medium
Fundamentals

#3What is HATEOAS and why does almost nobody implement it?

Hard
Fundamentals

#4When would you choose gRPC or GraphQL over REST?

Medium
Fundamentals

#5What is the Richardson Maturity Model?

Medium
Fundamentals

#6What is the difference between an API being idempotent and being safe?

Medium
Fundamentals

#7Should an API be synchronous or asynchronous, and how do you design a long-running operation?

Medium
Fundamentals

#8What is the difference between a public API and an internal one, in design terms?

Medium
Fundamentals

#9What does "self-descriptive messages" mean and why does it matter?

Medium
Fundamentals

#10How do you decide the granularity of an API — chatty versus chunky?

Hard
Fundamentals

#11What is the backend-for-frontend pattern and when is it justified?

Hard
Fundamentals

#12What is Hyrum's law and why does it matter for API design?

Hard
Fundamentals

#13How should you name and structure resource URLs?

Easy
Resource Modelling

#14How do you model an action that is not a CRUD operation?

Medium
Resource Modelling

#15Should you expose database IDs in your API?

Medium
Resource Modelling

#16How do you model a many-to-many relationship in a REST API?

Medium
Resource Modelling

#17Should nested resources be addressable independently?

Medium
Resource Modelling

#18How do you handle bulk operations?

Hard
Resource Modelling

#19What is a singleton resource and when is it appropriate?

Medium
Resource Modelling

#20How should search endpoints be designed?

Hard
Resource Modelling

Showing 1–20 of 100

Ask Aria about REST API Design

Sign in to chat with Aria

All 100 REST API Design questions at a glance
  1. What actually makes an API RESTful?(Medium)
  2. What does statelessness mean in practice, and what does it rule out?(Medium)
  3. What is HATEOAS and why does almost nobody implement it?(Hard)
  4. When would you choose gRPC or GraphQL over REST?(Medium)
  5. What is the Richardson Maturity Model?(Medium)
  6. What is the difference between an API being idempotent and being safe?(Medium)
  7. Should an API be synchronous or asynchronous, and how do you design a long-running operation?(Medium)
  8. What is the difference between a public API and an internal one, in design terms?(Medium)
  9. What does "self-descriptive messages" mean and why does it matter?(Medium)
  10. How do you decide the granularity of an API — chatty versus chunky?(Hard)
  11. What is the backend-for-frontend pattern and when is it justified?(Hard)
  12. What is Hyrum's law and why does it matter for API design?(Hard)
  13. How should you name and structure resource URLs?(Easy)
  14. How do you model an action that is not a CRUD operation?(Medium)
  15. Should you expose database IDs in your API?(Medium)
  16. How do you model a many-to-many relationship in a REST API?(Medium)
  17. Should nested resources be addressable independently?(Medium)
  18. How do you handle bulk operations?(Hard)
  19. What is a singleton resource and when is it appropriate?(Medium)
  20. How should search endpoints be designed?(Hard)
  21. Should URLs be plural or singular?(Easy)
  22. How do you expose computed or derived data?(Medium)
  23. How do you design an API for a resource that has multiple representations?(Hard)
  24. What is the difference between a resource and a representation?(Medium)
  25. What is the difference between PUT and PATCH?(Medium)
  26. When should POST create a resource versus PUT?(Medium)
  27. What should DELETE return, and what if the resource does not exist?(Medium)
  28. Why is returning 200 with an error in the body a bad idea?(Medium)
  29. When do you use 400 versus 422?(Medium)
  30. What is the correct status code for a successful creation, and what else should the response include?(Easy)
  31. How should you use 409 Conflict?(Medium)
  32. What is the difference between 401 and 403, and what about 404 for authorisation?(Medium)
  33. How should rate limiting be communicated to clients?(Medium)
  34. When would you use 410 Gone rather than 404?(Medium)
  35. Should GET ever have a request body?(Medium)
  36. What are the OPTIONS and HEAD methods for?(Easy)
  37. Should responses be wrapped in an envelope?(Medium)
  38. How should you handle null versus missing fields?(Hard)
  39. What naming convention should JSON fields use?(Easy)
  40. How should dates and times be represented?(Medium)
  41. How should monetary amounts be represented in an API?(Medium)
  42. How do you support sparse fieldsets and expansion?(Hard)
  43. What should you do about unknown fields in a request body?(Medium)
  44. How should enums be designed in an API?(Medium)
  45. How do you handle file uploads in a REST API?(Hard)
  46. What is content negotiation and how much of it should you implement?(Medium)
  47. Should you return the full resource after an update?(Medium)
  48. How should you design an API to be friendly to client code generation?(Hard)
  49. What are the options for API versioning and which would you choose?(Medium)
  50. What counts as a breaking change?(Medium)
  51. How do you deprecate an API version responsibly?(Medium)
  52. Should you version the whole API or individual resources?(Hard)
  53. How can you evolve an API without versioning at all?(Hard)
  54. How do you handle a bug in an API that clients have started depending on?(Hard)
  55. What is the difference between backward and forward compatibility?(Medium)
  56. How do you test that an API change is not breaking?(Hard)
  57. Compare offset and cursor pagination.(Medium)
  58. How do you implement a cursor correctly?(Hard)
  59. Should a paginated response include a total count?(Medium)
  60. How should filtering and sorting parameters be designed?(Medium)
  61. Where should pagination metadata go — body or headers?(Medium)
  62. What is the N+1 problem in an API context and how do you avoid it?(Medium)
  63. How do you paginate a resource that changes frequently?(Hard)
  64. What page size limits should an API enforce?(Easy)
  65. How would you design an API for exporting a large dataset?(Hard)
  66. Should list endpoints return full resources or summaries?(Medium)
  67. What should an error response body contain?(Medium)
  68. How do you report multiple validation errors?(Medium)
  69. How much internal detail should an error expose?(Medium)
  70. How should an API signal that a request may be retried?(Medium)
  71. What is a correlation ID and how should it flow through an API?(Medium)
  72. How do you handle partial failure in an API that calls multiple downstream services?(Hard)
  73. Should error messages be localised?(Medium)
  74. What is the most common error handling mistake you see in APIs?(Medium)
  75. What are the options for API authentication and when does each fit?(Medium)
  76. What are the trade-offs of using JWTs for API authentication?(Hard)
  77. Explain the OAuth 2.0 authorization code flow with PKCE.(Hard)
  78. What is the difference between OAuth 2.0 and OpenID Connect?(Hard)
  79. How should API keys be managed?(Medium)
  80. What is CSRF and does a REST API need protection from it?(Medium)
  81. What is insecure direct object reference and how do you prevent it?(Medium)
  82. How do you design an API for multi-tenancy safely?(Hard)
  83. What is mass assignment and how do you prevent it?(Medium)
  84. How should an API handle sensitive data in logs and responses?(Medium)
  85. What is the confused deputy problem in an API context?(Hard)
  86. How do you handle authorization for fine-grained permissions?(Hard)
  87. How do you make a REST API cacheable?(Medium)
  88. How do ETags support both caching and concurrency control?(Hard)
  89. How do you prevent a slow endpoint from taking down your API?(Hard)
  90. When should an API use compression, and what are the caveats?(Medium)
  91. How do you decide what to cache and where?(Medium)
  92. What is a cache stampede and how do you prevent it?(Hard)
  93. How do you measure and monitor API performance meaningfully?(Medium)
  94. What is conditional request handling and why is it underused?(Hard)
  95. What makes API documentation genuinely good?(Medium)
  96. Should the OpenAPI spec be written by hand or generated?(Medium)
  97. How do you design an API that other teams will actually adopt?(Medium)
  98. What are API design guidelines and why have them?(Medium)
  99. How do you decide whether something should be an API endpoint or an event?(Hard)
  100. If you inherited a badly designed API with many consumers, how would you improve it?(Hard)