Middle API Design Interview Questions (50 MCQs)

Question 1

A `POST /payments` request timed out and the client doesn't know if the charge happened. What is the best way to retry safely?

Accepted Answer

Send a unique `Idempotency-Key` header and retry with the same key

Answer

Switch the request to `GET` so it becomes idempotent automatically

Answer

Retry immediately unchanged and hope the server detects duplicates

Answer

Increase the client timeout and never retry

Question 2

A client sends `PUT /docs/1` with `If-Match: "v3"` but the current server version is `v4`. What should the server do?

Accepted Answer

Reject it and return `412 Precondition Failed`

Answer

Apply the change and return `200 OK`

Answer

Return `304 Not Modified`

Answer

Merge the changes and return `207`

Question 3

A user tries to register with a username that is already taken. Which status code is most precise?

Accepted Answer

`409 Conflict`

Answer

`404 Not Found`

Answer

`401 Unauthorized`

Answer

`412 Precondition Failed`

Question 4

In a feed where new items are constantly prepended, why is cursor pagination better than offset?

Accepted Answer

It anchors on a fixed position, so items aren't duplicated or skipped

Answer

Because a cursor allows jumping directly to any page number

Answer

Because a cursor removes the need for a database index

Answer

Because offset is not supported over HTTP/2

Question 5

How does keyset pagination fetch the next page of a list sorted by `created_at DESC, id DESC`?

Accepted Answer

`WHERE (created_at, id) < (:lastCreatedAt, :lastId) ORDER BY ... LIMIT n`

Answer

`ORDER BY created_at DESC LIMIT n OFFSET :page * n`

Answer

`WHERE id > :page ORDER BY RANDOM() LIMIT n`

Answer

`WHERE created_at = :lastCreatedAt LIMIT n`

Question 6

Per RFC 7807/9457 (Problem Details), what Content-Type does an error response use?

Accepted Answer

`application/problem+json`

Answer

`application/error+json`

Answer

`text/problem`

Answer

`application/json; type=error`

Question 7

`POST /reports` kicks off a report that takes several minutes. What is the appropriate response?

Accepted Answer

`202 Accepted` with `Location` pointing to a status resource like `/operations/123`

Answer

Hold the connection open until the report is ready, then `200 OK`

Answer

`201 Created` with an empty body and no headers

Answer

`503 Service Unavailable` until the report is ready

Question 8

The frontend uses `credentials: 'include'` and the server returns `Access-Control-Allow-Origin: *`. What happens?

Accepted Answer

The browser blocks it; with credentials an explicit origin must be returned

Answer

It succeeds because `*` covers every origin

Answer

The browser strips cookies but still reads the response

Answer

The server automatically replaces `*` with the request origin

Question 9

Which cross-origin request triggers a preflight?

Accepted Answer

`POST` with `Content-Type: application/json`

Answer

A plain `GET` with no custom headers

Answer

`POST` with `Content-Type: application/x-www-form-urlencoded`

Answer

`HEAD` with no custom headers

Question 10

How can you reduce repeated preflight requests?

Accepted Answer

Set `Access-Control-Max-Age` so the browser caches the preflight result

Answer

Set `Cache-Control: max-age` on the actual request

Answer

Respond `404` to `OPTIONS` requests

Answer

Add `Access-Control-Allow-Origin` to the client request

Question 11

What is the best client retry strategy upon receiving `429` or `503`?

Accepted Answer

Honor `Retry-After`, otherwise exponential backoff with jitter

Answer

Retry immediately in a loop until it succeeds

Answer

Retry at a fixed one-second interval for all clients

Answer

Change the method to `PUT` and resend

Question 12

How does the token bucket rate-limiting algorithm behave?

Accepted Answer

Tokens refill at a fixed rate and bursts up to bucket capacity are allowed

Answer

It queues requests and drains them at a perfectly constant rate

Answer

It resets a counter at the start of every minute

Answer

Each client may have only one concurrent request

Question 13

Why should an API return headers like `RateLimit-Limit` and `RateLimit-Remaining` even on successful responses?

Accepted Answer

So clients can throttle themselves before hitting `429`

Answer

Because browsers won't cache the response without them

Answer

Because CORS fails without these headers

Answer

So the server can verify the client's authentication

Question 14

What is the difference between a strong ETag `"abc"` and a weak ETag `W/"abc"`?

Accepted Answer

Weak means semantically equivalent, not necessarily byte-for-byte identical

Answer

Weak means it was generated with a weaker, insecure hash algorithm

Answer

Weak means it is valid for only one second

Answer

Weak means it is used only by CDNs

Question 15

A client previously got a response with `ETag: "a1"`. To revalidate without re-downloading the body, what should the next request include?

Accepted Answer

`If-None-Match: "a1"`; if unchanged the server returns `304`

Answer

`If-Match: "a1"`; if unchanged the server returns `412`

Answer

`ETag: "a1"` on the request; the server returns `204`

Answer

`Cache-Control: only-if-cached`; the server returns an empty `200`

Question 16

`GET /me` returns the user's personal data. Which `Cache-Control` fits?

Accepted Answer

`private, max-age=60`

Answer

`public, max-age=3600`

Answer

`public, s-maxage=86400`

Answer

`immutable, max-age=31536000`

Question 17

In `Cache-Control: max-age=60, s-maxage=600`, what does `s-maxage` control?

Accepted Answer

Freshness lifetime in shared caches like CDNs

Answer

Freshness lifetime only in the user's browser

Answer

The maximum server processing time

Answer

The lifetime of the user's session

Question 18

An API returns different responses based on `Accept-Language`. What header must be added so a CDN doesn't cache incorrectly?

Accepted Answer

`Vary: Accept-Language`

Answer

`Content-Language: *`

Answer

`Cache-Control: language`

Answer

`ETag: Accept-Language`

Question 19

What does HATEOAS mean in practice?

Accepted Answer

Responses include links to the related resources and possible next actions

Answer

All endpoints must be protected by HTTPS and OAuth

Answer

The server keeps client state in a session

Answer

The client must hardcode all URLs from the docs

Question 20

An API with distinct resources, proper HTTP verbs and status codes, but no hypermedia links is at which Richardson Maturity level?

Accepted Answer

Level 2

Answer

Level 0

Answer

Level 1

Answer

Level 3

Question 21

What is the main advantage of URL versioning (`/v1/...`) over header-based versioning?

Accepted Answer

Simple, visible, and easy to test in a browser, route, and cache

Answer

The resource URI never changes across versions

Answer

It allows versioning each field independently

Answer

It is the purest and most correct approach in REST terms

Question 22

Which example is media-type versioning?

Accepted Answer

`Accept: application/vnd.shop.v2+json`

Answer

`GET /api/2.0/products`

Answer

`GET /products?api-version=2`

Answer

`GET /products-v2`

Question 23

Which design for multi-field sorting (price descending, then name ascending) is common and readable?

Accepted Answer

`GET /products?sort=-price,name`

Answer

`GET /products/sort/price/desc/name/asc`

Answer

`POST /products/sort` with the order in the body

Answer

`GET /products?sortPriceDescThenNameAsc=true`

Question 24

A mobile client needs only `id` and `name` of users. What is a lightweight REST way to reduce over-fetching?

Accepted Answer

Support sparse fieldsets like `?fields=id,name`

Answer

Create a separate endpoint for every possible field combination

Answer

Gzip the response and keep returning every field

Answer

Randomly drop fields for mobile clients

Question 25

A non-atomic batch endpoint `POST /users/batch` receives 100 items, 3 of which are invalid. What is the best response?

Accepted Answer

A response with a per-item result and status (e.g. `207` or `200` with a results array)

Answer

`400 Bad Request` without identifying the failing items

Answer

`201 Created` while silently ignoring the invalid items

Answer

`500 Internal Server Error` for the whole batch

Question 26

The query `{ posts { author { name } } }` for 50 posts runs 51 database queries. Why?

Accepted Answer

The `author` resolver hits the database separately for each post (N+1 problem)

Answer

GraphQL always opens a new database connection per field

Answer

The schema is wrong because `author` should be a scalar

Answer

The client sent the query 51 times

Question 27

How does DataLoader solve the N+1 problem?

Accepted Answer

It collects keys requested in one tick and fetches them in one batch call like `WHERE id IN (...)`

Answer

It keeps every user's results forever in a global cache

Answer

It spreads queries in parallel across multiple databases

Answer

It removes nested fields from the schema

Question 28

In GraphQL over HTTP, what typically happens when one field in a query errors?

Accepted Answer

A `200` response with partial `data` and details in an `errors` array

Answer

The whole response becomes `500` with no data

Answer

The server returns `404` for that field

Answer

The field silently becomes `null` with no error reported

Question 29

Over which transport are GraphQL subscriptions usually implemented?

Accepted Answer

WebSocket (e.g. the `graphql-ws` protocol) or SSE

Answer

Plain `GET` requests with long caching

Answer

Only gRPC over HTTP/2

Answer

Email and webhooks

Question 30

In a GraphQL schema, what does `email: String!` mean and what is the risk?

Accepted Answer

It is never null; if the resolver fails, the null propagates up to the nearest nullable parent

Answer

It is required in mutations but may be null in queries

Answer

The field is private and only admins can read it

Answer

The field is deprecated and will be removed soon

Question 31

What are fragments used for in GraphQL?

Accepted Answer

Defining a reusable set of fields on a type and composing it into queries

Answer

Splitting a large response into multiple HTTP responses

Answer

Defining new types in the server schema

Answer

Encrypting part of the query before sending

Question 32

Which RPC types does gRPC support?

Accepted Answer

Unary, server streaming, client streaming, and bidirectional streaming

Answer

Only unary; streaming requires WebSocket

Answer

Unary and server streaming; clients cannot stream

Answer

Only bidirectional streaming

Question 33

You remove a field from a protobuf message. What should you do to stay compatible?

Accepted Answer

Mark its number (and name) as `reserved` so it's never reused

Answer

Assign its number to the next new field to avoid gaps

Answer

Decrement the numbers of all following fields

Answer

Rewrite the whole message under a new name

Question 34

Why can't a browser call a standard gRPC service directly?

Accepted Answer

Browser APIs don't expose enough control over HTTP/2 frames and trailers; gRPC-Web plus a proxy is needed

Answer

Browsers don't support HTTP/2

Answer

Protobuf cannot be parsed in JavaScript

Answer

gRPC works only over UDP

Question 35

In gRPC, why should clients set a deadline on every call?

Accepted Answer

So stuck calls don't hold resources forever and servers can abandon useless work

Answer

Because protobuf messages can't be serialized without one

Answer

Because HTTP/2 won't open a connection without one

Answer

So responses are cached automatically

Question 36

How does a webhook receiver verify a request truly came from the provider?

Accepted Answer

Compute an HMAC over the raw body with a shared secret and compare it in constant time to the signature header

Answer

Check that the `User-Agent` header names the provider

Answer

Parse the JSON and compare the signature against its `JSON.stringify`

Answer

Accept any request that arrived over HTTPS

Question 37

A webhook provider retries several times if it doesn't get a `2xx`. How should the receiver be designed?

Accepted Answer

Respond `2xx` quickly, process via a queue, and dedupe by event ID

Answer

Do all the processing synchronously before responding

Answer

Always return `500` so the provider resends

Answer

Assume each event arrives exactly once and in order

Question 38

How does long polling work?

Accepted Answer

The server holds the request open until new data or a timeout, then the client immediately re-requests

Answer

The client sends a request every few seconds and the server answers immediately

Answer

A full-duplex connection opens and both sides send messages

Answer

The server sends an HTTP request to the client's address

Question 39

For a dashboard that only receives price updates from the server, why might SSE beat WebSocket?

Accepted Answer

It's simpler, runs over plain HTTP, and has auto-reconnect with `Last-Event-ID`

Answer

SSE carries binary data more efficiently than WebSocket

Answer

SSE also lets the client send messages to the server

Answer

SSE does not need any persistent connection

Question 40

What is the most important improvement of HTTP/2 over HTTP/1.1?

Accepted Answer

Multiplexing many concurrent requests over one TCP connection

Answer

Using UDP instead of TCP

Answer

Removing headers from requests entirely

Answer

Making JSON mandatory for all responses

Question 41

Why do browsers open multiple parallel TCP connections per domain with HTTP/1.1?

Accepted Answer

Because each connection delivers only one response at a time (head-of-line blocking)

Answer

Because HTTP/1.1 does not support keep-alive

Answer

Because each connection can carry only one Content-Type

Answer

Because TLS works for only one request per connection

Question 42

What problem does consumer-driven contract testing (e.g. with Pact) solve?

Accepted Answer

The provider verifies changes don't break consumers' real expectations, without full E2E tests

Answer

It measures server load under heavy traffic

Answer

It finds security vulnerabilities in the API

Answer

It automatically generates API docs from code

Question 43

What is the benefit of a design-first approach with OpenAPI?

Accepted Answer

The contract is reviewed before coding and teams work in parallel with mocks and generated code

Answer

It completely removes the need for tests

Answer

It makes API responses faster

Answer

It guarantees the API never has breaking changes

Question 44

Which responsibility is typically delegated to an API gateway?

Accepted Answer

Routing, authentication, rate limiting, and TLS termination for backend services

Answer

Holding the core business logic of every service

Answer

Managing database schemas and migrations

Answer

Rendering the client-side UI

Question 45

What is the Backend for Frontend (BFF) pattern?

Accepted Answer

A dedicated backend layer per client type that aggregates and shapes data for that UI

Answer

A shared database for frontend and backend

Answer

A library for running backend code in the browser

Answer

One public API for all clients and partners

Question 46

How can you tell clients in a machine-readable way that an endpoint is deprecated and will be removed on a date?

Accepted Answer

The `Deprecation` and `Sunset` headers (with a link to migration docs)

Answer

Returning `410 Gone` starting today

Answer

A `Cache-Control: deprecated` header

Answer

Randomly changing status codes to encourage migration

Question 47

Which change to a REST API is usually backward compatible?

Accepted Answer

Adding a new optional field to the response

Answer

Renaming an existing response field

Answer

Making a previously optional parameter required

Answer

Changing a field's type from number to string

Question 48

A client sends `PUT /settings/theme` for a resource that doesn't exist yet, and the server creates it. What's the right response?

Accepted Answer

`201 Created`; subsequent replacing PUTs return `200` or `204`

Answer

Always `404 Not Found` because PUT cannot create resources

Answer

`202 Accepted` for every PUT

Answer

`303 See Other` to a `POST` endpoint

Question 49

Why is putting an API key in the query string like `?api_key=...` discouraged?

Accepted Answer

Because URLs end up in server and proxy logs, browser history, and the Referer header

Answer

Because HTTPS does not encrypt the query string

Answer

Because the query string accepts at most 10 characters

Answer

Because servers cannot read the query string

Question 50

In JSON Merge Patch (`application/merge-patch+json`), what does sending `{ "nickname": null }` mean?

Accepted Answer

Remove the `nickname` field from the resource

Answer

Leave the `nickname` field unchanged

Answer

Store the string `'null'` in `nickname`

Answer

The request is invalid and must return `400`