Junior API Design Interview Questions (50 MCQs)

Question 1

What is the HTTP `GET` method designed for?

Accepted Answer

Retrieving a resource without changing server state

Answer

Creating a new resource on the server

Answer

Deleting a resource from the server

Answer

Fully replacing an existing resource

Question 2

Which group of HTTP methods is considered 'safe' by the spec?

Accepted Answer

`GET`, `HEAD`, `OPTIONS`

Answer

`GET`, `PUT`, `DELETE`

Answer

`POST`, `PATCH`, `GET`

Answer

`HEAD`, `PUT`, `PATCH`

Question 3

What does it mean for an HTTP method to be 'idempotent'?

Accepted Answer

Repeating the same request many times has the same server effect as sending it once

Answer

The request never changes any data on the server

Answer

The response always returns exactly the same body

Answer

The request is always cached by the browser

Question 4

Which HTTP method is NOT idempotent by default?

Accepted Answer

`POST`

Answer

`PUT`

Answer

`DELETE`

Answer

`GET`

Question 5

What is the main difference between `PUT` and `PATCH`?

Accepted Answer

`PUT` replaces the whole resource, `PATCH` applies a partial modification

Answer

`PUT` is only for creation and `PATCH` only for deletion

Answer

`PATCH` is safe but `PUT` is not

Answer

`PUT` has no body while `PATCH` has a body

Question 6

After successfully creating a resource with `POST`, which status code is most appropriate?

Accepted Answer

`201 Created`

Answer

`200 OK`

Answer

`202 Accepted`

Answer

`204 No Content`

Question 7

When is `204 No Content` appropriate?

Accepted Answer

When the operation succeeded but there is no body to return

Answer

When the requested resource was not found

Answer

When the server has not processed the request yet

Answer

When the client lacks permission

Question 8

What is the difference between `401 Unauthorized` and `403 Forbidden`?

Accepted Answer

`401` means not authenticated; `403` means identity is known but access is denied

Answer

`401` means access denied; `403` means not authenticated

Answer

Both mean exactly the same and are interchangeable

Answer

`401` is a server error and `403` is a client error

Question 9

What status code should `GET /users/999` return for a user that does not exist?

Accepted Answer

`404 Not Found`

Answer

`400 Bad Request`

Answer

`500 Internal Server Error`

Answer

`200 OK` with an empty body

Question 10

What do `4xx` and `5xx` codes indicate respectively?

Accepted Answer

`4xx` client-side errors, `5xx` server-side errors

Answer

`4xx` server-side errors, `5xx` client-side errors

Answer

`4xx` partial success, `5xx` redirects

Answer

`4xx` network errors, `5xx` DNS errors

Question 11

What does the `Content-Type` header specify in a `POST` request?

Accepted Answer

The media type of the body being sent

Answer

The format the client wants in the response

Answer

The length of the body in bytes

Answer

The user's preferred language

Question 12

What is the `Accept` header used for?

Accepted Answer

Declaring which media types the client can accept in the response

Answer

Confirming that the client accepted the terms of use

Answer

Specifying the format of the request body

Answer

Indicating the user accepted cookies

Question 13

In which header is a JWT usually sent to an API?

Accepted Answer

`Authorization: Bearer <token>`

Answer

`Authentication: Token <token>`

Answer

`X-Session: <token>`

Answer

`Accept: Bearer <token>`

Question 14

What does the `Location` header convey in a `201 Created` response?

Accepted Answer

The URI of the newly created resource

Answer

The geographic location of the server

Answer

The client's IP address

Answer

The path of the request log file on the server

Question 15

Which URI follows common REST naming conventions?

Accepted Answer

`GET /users/42/orders`

Answer

`GET /getUserOrders?id=42`

Answer

`POST /users/42/fetchOrders`

Answer

`GET /User/42/Order/List`

Question 16

Which endpoint is more conventional for a collection of products?

Accepted Answer

`/products` and `/products/{id}`

Answer

`/product` and `/product-item/{id}`

Answer

`/getProducts` and `/getProduct/{id}`

Answer

`/products/list` and `/products/detail?id=`

Question 17

What does the REST 'statelessness' constraint mean?

Accepted Answer

Each request carries all needed info; the server keeps no client session state

Answer

The server must not store any data in a database

Answer

Responses must never be cached

Answer

The client must not hold any token or cookie

Question 18

Which design is more common for filtering a list of orders by status?

Accepted Answer

`GET /orders?status=shipped`

Answer

`GET /orders/status/shipped/filter`

Answer

`POST /orders/filter` with an empty body

Answer

`GET /filterOrdersByStatus/shipped`

Question 19

If `DELETE /items/5` is sent twice, why is it still considered idempotent?

Accepted Answer

Because the final server state (item gone) is the same either way

Answer

Because the server always ignores the second request and returns `200`

Answer

Because the browser caches the second request

Answer

Because `DELETE` is a safe method

Question 20

A client sends malformed JSON (broken syntax). Which response is most appropriate?

Accepted Answer

`400 Bad Request`

Answer

`500 Internal Server Error`

Answer

`404 Not Found`

Answer

`405 Method Not Allowed`

Question 21

A client sends `DELETE /users`, but the endpoint only supports `GET` and `POST`. What is the right response?

Accepted Answer

`405 Method Not Allowed` with an `Allow` header

Answer

`404 Not Found` with no headers

Answer

`403 Forbidden` with an `Allow` header

Answer

`501 Not Implemented` for every method

Question 22

An unexpected exception occurred in server code. Which status code fits?

Accepted Answer

`500 Internal Server Error`

Answer

`400 Bad Request`

Answer

`503 Service Unavailable`

Answer

`418 I'm a teapot`

Question 23

What is the difference between `301` and `302`?

Accepted Answer

`301` is a permanent redirect and `302` is temporary

Answer

`301` is temporary and `302` is permanent

Answer

`301` is a client error and `302` is a server error

Answer

There is no difference; only the names differ

Question 24

What does `304 Not Modified` mean?

Accepted Answer

The client's cached copy is still valid; no body is sent

Answer

The resource was deleted and no longer exists

Answer

The server does not allow modifying the resource

Answer

The modification request did not succeed

Question 25

What is the `ETag` header?

Accepted Answer

An identifier for a specific version of a resource representation

Answer

An authentication token for the user

Answer

The cache expiry time in seconds

Answer

A unique request ID for logging

Question 26

What does `Cache-Control: no-store` do?

Accepted Answer

No cache is allowed to store the response at all

Answer

The response is cached but must be revalidated before use

Answer

The response is cached only in the CDN

Answer

The response is cached forever

Question 27

Which status code does the server return when a client exceeds the rate limit?

Accepted Answer

`429 Too Many Requests`

Answer

`403 Forbidden`

Answer

`503 Service Unavailable`

Answer

`413 Payload Too Large`

Question 28

What is the standard media type for a JSON response?

Accepted Answer

`application/json`

Answer

`text/json`

Answer

`application/javascript`

Answer

`json/application`

Question 29

What exactly is REST?

Accepted Answer

An architectural style with constraints like statelessness and a uniform interface

Answer

A network protocol that replaces HTTP

Answer

A JavaScript library for calling APIs

Answer

A data format like JSON or XML

Question 30

To fetch the comments of a specific post, which URI is clearest?

Accepted Answer

`GET /posts/7/comments`

Answer

`GET /comments/getByPost/7`

Answer

`GET /posts-comments-7`

Answer

`POST /posts/7/comments/get`

Question 31

What does the `HEAD` method do?

Accepted Answer

Returns the same response as `GET` but headers only, no body

Answer

Sends only request headers to the server and strips the body

Answer

Returns the first item of a collection

Answer

Locks the resource so nobody else can modify it

Question 32

Which HTTP method does the browser use for a CORS preflight?

Accepted Answer

`OPTIONS`

Answer

`HEAD`

Answer

`GET`

Answer

`CONNECT`

Question 33

Who does CORS restrict?

Accepted Answer

The browser, which allows or blocks reading cross-origin responses based on server headers

Answer

The server, which rejects requests without an Origin header

Answer

All clients, including curl and Postman

Answer

The network firewall between client and server

Question 34

Why should list endpoints be paginated?

Accepted Answer

To bound response size and server load as data grows

Answer

Because JSON cannot represent large arrays

Answer

Because HTTP only permits responses under 1 MB

Answer

To force the client to send POST requests

Question 35

Which records does `GET /items?limit=20&offset=40` return?

Accepted Answer

Records 41 through 60

Answer

Records 20 through 40

Answer

Records 40 through 80

Answer

Records 1 through 40

Question 36

Which example shows URL-based versioning?

Accepted Answer

`GET /v2/users`

Answer

`Accept: application/vnd.app.v2+json`

Answer

`X-API-Version: 2`

Answer

`GET /users` with a body containing `version: 2`

Question 37

What is OpenAPI (formerly Swagger)?

Accepted Answer

A standard specification for machine-readable descriptions of HTTP APIs

Answer

A framework for building servers in Node.js

Answer

A protocol for realtime communication

Answer

A free public API for testing

Question 38

What is GraphQL's key feature from the client's perspective?

Accepted Answer

The client specifies exactly the fields it needs in the query

Answer

Every resource has its own separate URL

Answer

Responses are automatically cached by the browser

Answer

It uses only the `DELETE` method to change data

Question 39

In GraphQL, what is the difference between `query` and `mutation`?

Accepted Answer

`query` reads data and `mutation` changes data

Answer

`query` runs on the server and `mutation` on the client

Answer

`mutation` is for realtime connections

Answer

There is no difference except the name

Question 40

What does 'over-fetching' mean in REST?

Accepted Answer

An endpoint returns more data than the client needs

Answer

The client must send several requests for one screen

Answer

The server receives too many requests

Answer

The client caches data too aggressively

Question 41

What role does the schema play in GraphQL?

Accepted Answer

It defines the types and operations available and is the client-server contract

Answer

It defines the database table structure

Answer

It defines how long responses are cached

Answer

It is only documentation and unused at runtime

Question 42

What is a resolver in GraphQL?

Accepted Answer

A function that produces the value for a field in the schema

Answer

A tool for resolving git conflicts in the schema file

Answer

A server that resolves the DNS of the GraphQL endpoint

Answer

A client-side library for building queries

Question 43

What format and transport does gRPC use by default?

Accepted Answer

Protocol Buffers over HTTP/2

Answer

JSON over HTTP/1.1

Answer

XML over SOAP

Answer

YAML over WebSocket

Question 44

What is a webhook?

Accepted Answer

An HTTP callback the server sends to your URL when an event happens

Answer

A React hook for calling APIs

Answer

A persistent connection the client keeps open

Answer

A browser tool for debugging requests

Question 45

When is WebSocket a better fit than regular HTTP requests?

Accepted Answer

When low-latency, bidirectional realtime communication is needed, like chat

Answer

When you want responses cached in a CDN

Answer

For one-off downloads of large files

Answer

For simple CRUD endpoints

Question 46

What kind of communication does Server-Sent Events (SSE) provide?

Accepted Answer

A one-way stream of events from server to client over HTTP

Answer

Bidirectional binary communication between client and server

Answer

One-way data upload from client to server

Answer

Peer-to-peer communication between two browsers

Question 47

The JSON is syntactically valid, but the `email` field is malformed. Which code is commonly used?

Accepted Answer

`422 Unprocessable Content`

Answer

`415 Unsupported Media Type`

Answer

`409 Conflict`

Answer

`500 Internal Server Error`

Question 48

A client sends `Content-Type: text/xml` but the API only accepts JSON. Appropriate response?

Accepted Answer

`415 Unsupported Media Type`

Answer

`406 Not Acceptable`

Answer

`404 Not Found`

Answer

`401 Unauthorized`

Question 49

The server is temporarily down for maintenance. Which response fits best?

Accepted Answer

`503 Service Unavailable` with `Retry-After`

Answer

`500 Internal Server Error` with `Location`

Answer

`404 Not Found` with `Cache-Control`

Answer

`410 Gone` with `Retry-After`

Question 50

Why should APIs carrying tokens or sensitive data be served only over HTTPS?

Accepted Answer

Because HTTPS encrypts traffic and prevents eavesdropping and tampering in transit

Answer

Because HTTPS always doubles response speed

Answer

Because JSON cannot be sent over HTTP

Answer

Because HTTPS removes the need for authentication