50 API Testing Interview Questions & Answers (2026 Guide)

API testing has moved from a “nice to have” to a core skill for QA engineers in India. Whether the role is manual, automation or SDET, expect at least a few API testing interview questions — and for backend-heavy teams, an entire round on them.

This guide covers 50 questions in six groups: fundamentals, status codes, security, test design, tools and advanced topics (GraphQL, webhooks, rate limits, async APIs and framework design). The answers are short so you can revise quickly; in the interview, add an example from an API you have actually tested.

Key takeaways

• Know HTTP methods, idempotency and status codes thoroughly — they are asked in nearly every round.
• Be able to list positive, negative and security test cases for any endpoint.
• Show tool knowledge with Postman and, for automation roles, REST Assured or a similar library.

API fundamentals (1–10)

1. What is an API?
An Application Programming Interface is a contract that lets one software system request data or actions from another, typically over HTTP for web APIs.

2. What is API testing?
Testing the business logic, data, error handling, security and performance of APIs directly, without a UI, by sending requests and validating responses.

3. Why is API testing important?
It finds defects earlier, runs faster and is more stable than UI tests, and covers logic the UI may never expose.

4. REST vs SOAP?
REST is an architectural style using HTTP methods and usually JSON; it is lightweight and flexible. SOAP is a protocol using XML envelopes with strict standards such as WS-Security, still common in banking and legacy systems.

5. What are REST constraints?
Client-server, statelessness, cacheability, uniform interface, layered system and optional code-on-demand. Statelessness means each request carries everything the server needs.

6. Name the common HTTP methods.
GET (read), POST (create), PUT (replace), PATCH (partial update), DELETE (remove), plus HEAD and OPTIONS.

7. What is idempotency?
Repeating the same request gives the same server state. GET, PUT, DELETE, HEAD and OPTIONS are idempotent; POST is not, and PATCH is not guaranteed to be.

8. PUT vs PATCH?
PUT replaces the whole resource with the payload; PATCH changes only the fields sent.

9. POST vs PUT?
POST usually creates a new resource and the server assigns the ID. PUT targets a known URI and creates or replaces the resource there.

10. Path parameter vs query parameter?
Path parameters identify a resource, as in /users/42. Query parameters filter, sort or paginate, as in /users?page=2&limit=20.

Status code questions (11–16)

11. What do the status code classes mean?
1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error.

12. 200 vs 201 vs 204?
200 is generic success with a body, 201 confirms creation (often with a Location header), and 204 is success with no body.

13. 400 vs 422?
400 means the request is malformed or invalid. 422 means the syntax is fine but the content fails validation rules; some APIs use 400 for both.

14. 401 vs 403?
401: the server does not know who you are. 403: it knows who you are, but you lack permission.

15. When is a 500 response a bug?
Almost always when caused by client input. Invalid input should return a 4xx with a clear message, not crash the server.

16. 502 vs 503 vs 504?
502 Bad Gateway: an upstream server sent an invalid response. 503 Service Unavailable: the server is overloaded or down for maintenance. 504 Gateway Timeout: the upstream did not respond in time.

Authentication and security (17–22)

17. Authentication vs authorization?
Authentication verifies identity; authorization decides what that identity may access.

18. What is Basic authentication?
Username and password Base64-encoded in the Authorization header. Encoding is not encryption, so it must only be used over HTTPS.

19. What is a JWT?
A JSON Web Token has three Base64URL-encoded parts — header, payload and signature. It is signed, not encrypted, so it must not carry secrets. Test expiry, tampered signatures and missing claims.

20. What is OAuth 2.0?
An authorization framework that issues access tokens to clients on behalf of a user, using flows such as authorization code or client credentials.

21. API key vs token?
An API key identifies the calling application and is usually long-lived. A token typically represents a user session and expires.

22. Which security tests do you run on APIs?
Missing or invalid tokens, accessing another user’s data by changing IDs (broken object-level authorization), injection payloads, rate limiting, sensitive data in responses, and HTTPS enforcement.

Test design questions (23–30)

23. What do you validate in an API response?
Status code, body values and data types, schema, headers, response time, and the actual effect in the database or downstream systems.

24. Write test cases for a “create user” API.
Valid payload returns 201; missing required fields, invalid email, duplicate email, wrong data types and oversized strings return 4xx; no token returns 401; the created user can be fetched with GET.

25. What is schema validation?
Checking the response structure — fields, types, required properties — against a JSON Schema or contract so breaking changes are caught early.

26. What is contract testing?
Verifying that a provider API and its consumers agree on request and response formats, often with tools such as Pact.

27. What are mocks and stubs?
Simulated APIs that return predefined responses, used when a real dependency is unavailable, unstable or costly to call.

28. What is API chaining?
Using data from one response in the next request — for example, logging in to get a token, creating an order, then fetching it by the returned ID.

29. How do you test pagination?
Check page size limits, first and last pages, out-of-range pages, total counts, stable ordering and no duplicates or gaps between pages.

30. How do you test an API when the UI is not ready?
Use the API specification (such as OpenAPI/Swagger) to design tests and run them directly in Postman or code — that is the main advantage of API testing.

Tools and automation (31–35)

31. Which Postman features have you used?
Collections, environments and variables, pre-request and post-response scripts, the Collection Runner with data files, and mock servers. See our Postman API testing tutorial for a walkthrough.

32. What is Newman?
Postman’s command-line runner, used to execute collections in CI pipelines and generate reports such as JUnit.

33. Write a simple REST Assured test.
REST Assured is a Java library that uses a given/when/then style:

import static io.restassured.RestAssured.given;
import static org.hamcrest.Matchers.equalTo;
import org.testng.annotations.Test;

public class PostApiTest {

    @Test
    public void getPostReturnsCorrectData() {
        given()
            .baseUri("https://jsonplaceholder.typicode.com")
        .when()
            .get("/posts/1")
        .then()
            .statusCode(200)
            .body("id", equalTo(1))
            .body("userId", equalTo(1));
    }
}

34. How do you run API tests in CI?
Trigger Newman or a Maven/TestNG suite from Jenkins or GitHub Actions on every build, publish the reports, and fail the pipeline on test failures.

35. How do you performance test an API?
Use JMeter or k6 to simulate concurrent users, then measure response times, throughput and error rates against agreed limits.

Advanced API testing questions (36–50)

36. What is GraphQL and how is testing it different from REST?
GraphQL exposes a single endpoint where the client sends a query describing exactly which fields it needs. Tests focus on query/mutation correctness, field-level authorisation, nested data, error objects (GraphQL often returns 200 with an errors array), query depth/complexity limits and schema changes.

37. What is a webhook and how do you test one?
A webhook is an HTTP callback the server sends to your URL when an event happens (payment captured, order shipped). Test it with a request-capture tool or mock server: verify payload, signature header, retries on failure, idempotent handling of duplicate events and correct behaviour when events arrive out of order.

38. How do you test rate limiting?
Send requests above the allowed limit within the window and verify a 429 Too Many Requests response, a Retry-After or rate-limit headers, that normal service resumes after the window, and that limits apply per user/key as designed.

39. What is CORS and when does it matter in testing?
Cross-Origin Resource Sharing is a browser rule that blocks a web page from calling an API on another origin unless the API returns headers such as Access-Control-Allow-Origin. It matters when the UI and API are on different domains: test the preflight OPTIONS response and that only allowed origins are accepted. Postman is not affected by CORS — only browsers are.

40. Which response headers do you validate?
Content-Type, Cache-Control/ETag, Location for 201, pagination headers, rate-limit headers, and security headers like Strict-Transport-Security and X-Content-Type-Options. Also check that sensitive data (server versions, stack traces) is not exposed.

41. How do you test a file upload API?
Send multipart/form-data with valid files and verify the stored file. Negative tests: wrong type, empty file, file above the size limit, malicious extensions (.exe renamed to .pdf), very long file names and concurrent uploads.

42. What is API versioning and how do you test backward compatibility?
Versions are exposed via the URL (/v1/), a header or a parameter. Run the old version’s test suite against the new release to confirm existing clients still work, check that removed fields are deprecated first, and that new required fields do not break old requests.

43. How do you test asynchronous APIs?
Such APIs return 202 Accepted with a job id. The test polls the status endpoint (with a timeout and interval) until the job is completed or failed, then validates the result. Also test timeouts, failed jobs and duplicate submissions.

44. How do you pass a token from one request to the next in Postman?
Extract it in the Tests (post-response) script and save it to an environment variable, then use {{token}} in the next request’s Authorization header:

// Post-response script of the login request
const body = pm.response.json();
pm.environment.set("token", body.accessToken);

// Assertions
pm.test("status is 200", () => pm.response.to.have.status(200));
pm.test("fast enough", () => pm.expect(pm.response.responseTime).to.be.below(800));

45. What is JSONPath? Give examples.
A query language to pick values from JSON. Examples: $.data.id, $.items[0].price, $.items[*].sku (all SKUs), $.items[?(@.price > 500)].name (filter). REST Assured uses a similar GPath syntax: body("items.size()", equalTo(3)).

46. How do you validate response time?
Add an assertion on response time per request (Postman pm.response.responseTime, REST Assured time(lessThan(800L))). For realistic numbers under load use JMeter or k6 and check p95/p99, not just one request.

47. What is an idempotency key?
A unique key sent in a header (for example Idempotency-Key) on POST requests such as payments, so retries with the same key do not create a second charge. Test by sending the same request twice with the same key (one transaction) and with different keys (two transactions).

48. List negative test cases for any API.
Missing/invalid auth, expired token, wrong HTTP method, missing required fields, wrong data types, values beyond limits, invalid enums, SQL/script injection in strings, extra unknown fields, malformed JSON, wrong Content-Type, non-existent ids, duplicate creation and very large payloads. Each should return the correct 4xx code and a clear error message.

49. How do you test SOAP web services?
Load the WSDL in SoapUI (or Postman), send XML requests in a SOAP envelope, and validate the response with XPath assertions, schema compliance and SOAP faults for invalid input. WS-Security headers are common in banking.

50. How would you design an API automation framework?
REST Assured (or Playwright request) with Java/TypeScript, a base request specification (base URL, headers, auth) per environment, POJOs or builders for payloads, schema files for validation, test data factories, reusable clients per service, TestNG/JUnit with tags (smoke/regression), Allure reports and CI execution on every build.

RequestSpecification spec = new RequestSpecBuilder()
    .setBaseUri(Config.get("baseUrl"))
    .addHeader("Authorization", "Bearer " + TokenManager.get())
    .setContentType(ContentType.JSON)
    .build();

given().spec(spec).body(new User("Asha", "tester"))
.when().post("/users")
.then().statusCode(201)
    .body(matchesJsonSchemaInClasspath("schemas/user.json"))
    .body("name", equalTo("Asha"));

How to answer API testing interview questions well

Interviewers care less about textbook definitions and more about how you think. When asked to test an endpoint, structure your answer: positive cases, negative cases, boundary values, security, and performance. Mention what you would verify beyond the response, such as the database record. For automation roles, be ready to write a short REST Assured test or Postman script live. The official REST Assured documentation is worth a read before your interview, and if you also face manual rounds, revise our manual testing interview questions.

FAQs

Are API testing interview questions asked to freshers?

Yes, increasingly. Freshers are usually asked about HTTP methods, status codes and basic Postman usage.

Do I need coding for API testing roles?

Manual API testing with Postman needs little coding. Automation roles expect Java, Python or JavaScript.

Which tool should I learn first?

Postman first to understand APIs, then REST Assured, or a Python or JavaScript HTTP library, for automation.

How do I practise without a work project?

Use free public APIs such as JSONPlaceholder or ReqRes, build a collection with assertions and share it on GitHub.

Conclusion

These API testing interview questions cover what most Indian QA interviews ask, from REST basics to automation. Revise them, practise on a public API and prepare one real example for each group. When you are ready, browse the daily QA jobs list for API and backend testing openings.