Senior API Design Interview Questions (50 MCQs)

Question 1

Why is it recommended that a public API's cursor be an opaque string (e.g. encoded base64) rather than a raw `id`?

Accepted Answer

So the implementation (sort keys, structure) can change later without breaking clients

Answer

Because base64 secures the data against any tampering

Answer

Because databases accept only base64 strings in `WHERE`

Answer

Because numeric cursors cannot be represented in JSON

Question 2

In an idempotency-key implementation, what is correct if a second request arrives with the same key but a different body?

Accepted Answer

Reject it with an error (e.g. `422` or `409`) since the key was used for a different payload

Answer

Execute the new request and overwrite the stored result

Answer

Silently return the previous response with no warning

Answer

Delete the key and execute both requests

Question 3

In distributed systems, how is 'exactly-once' delivery of messages/requests usually achieved?

Accepted Answer

With at-least-once delivery plus idempotent processing or deduplication at the receiver

Answer

By using TCP, which guarantees exactly-once delivery

Answer

By disabling all client retries

Answer

With HTTP/2, which removes duplicate requests

Question 4

A malicious client sends deeply nested queries like `friends { friends { friends { ... } } }`. What is the most effective defense?

Accepted Answer

Depth limits and pre-execution cost analysis, with cost-based rate limiting

Answer

Limiting HTTP requests per minute regardless of query contents

Answer

Enabling gzip on responses

Answer

Making all fields non-null

Question 5

What benefits do persisted queries bring to GraphQL?

Accepted Answer

Sending a hash instead of query text, enabling `GET` + CDN caching and allowlisting permitted queries

Answer

Storing responses in the database forever

Answer

Removing the need for server resolvers

Answer

Automatically converting queries into mutations

Question 6

In Apollo Federation, how does the Reviews service add a `reviews` field to the `User` type owned by the Accounts service?

Accepted Answer

It treats `User` as an entity with `@key(fields: "id")` and extends it in its own subgraph; the router composes via reference resolvers

Answer

Reviews connects directly to the Accounts database and reads the users table

Answer

The whole schema is written in one shared file copied into both services

Answer

The client sends two separate queries and joins the results itself

Question 7

Why is HTTP caching harder in GraphQL than REST, and how do clients like Apollo compensate?

Accepted Answer

Everything is usually `POST` to one endpoint; clients build a normalized cache keyed by `__typename` and `id`

Answer

GraphQL responses are binary and uncacheable

Answer

GraphQL does not support HTTP headers

Answer

The GraphQL spec explicitly forbids caching

Question 8

What is the common approach to evolving a GraphQL schema instead of versioning (`/v2/graphql`)?

Accepted Answer

Add new fields, mark old ones `@deprecated`, and remove them once field-level usage metrics reach zero

Answer

Rename fields in place and announce by email

Answer

Build a completely new schema for every release

Answer

Disable introspection so clients don't notice changes

Question 9

Which change to a protobuf message still used by old clients is breaking?

Accepted Answer

Changing field `3` from `string` to `int64`

Answer

Adding a new field with unused number `7`

Answer

Renaming a field without changing its number (for binary encoding)

Answer

Removing a field and reserving its number

Question 10

In proto3, how can you tell whether `int32 discount` was not sent or was explicitly `0`?

Accepted Answer

Declare it `optional` (or use a wrapper like `Int32Value`) so presence is tracked

Answer

`0` always means unset, so nothing is needed

Answer

Use `required`, which proto3 recommends

Answer

Make the field number negative to allow null

Question 11

Why does a plain L4 load balancer in Kubernetes distribute gRPC load unevenly across pods?

Accepted Answer

gRPC multiplexes over one long-lived HTTP/2 connection and L4 balances connections, not requests

Answer

gRPC uses UDP, which L4 doesn't support

Answer

Protobuf makes every request hash identically

Answer

Kubernetes blocks gRPC traffic by default

Question 12

Which remaining HTTP/2 problem does HTTP/3 solve?

Accepted Answer

TCP-level head-of-line blocking; with QUIC over UDP a lost packet stalls only its own stream

Answer

The lack of multiplexing in HTTP/2

Answer

HTTP/2's lack of TLS support

Answer

The lack of header compression in HTTP/2

Question 13

TLS 1.3/QUIC allow sending 0-RTT data. Why do servers usually accept only safe requests in 0-RTT?

Accepted Answer

0-RTT data can be replayed by an attacker, so a `POST` might execute twice

Answer

0-RTT data isn't encrypted at all and is readable

Answer

0-RTT only supports the `GET` method at the protocol level

Answer

0-RTT makes responses uncacheable

Question 14

Which attack does an HMAC over the body alone fail to stop, and what is the fix?

Accepted Answer

Replay attacks; include a timestamp in the signed content and reject requests outside a tolerance window

Answer

XSS; by escaping the body before signing

Answer

SQL injection; by signing the database query

Answer

CSRF; by adding a cookie to the webhook request

Question 15

A service must reliably emit an `order.created` webhook after committing an order. Which pattern prevents losing the event?

Accepted Answer

Transactional outbox: write the event to an outbox table in the same transaction and deliver via a separate worker

Answer

Send the webhook before committing the transaction

Answer

Send the webhook in a `setTimeout` after responding to the user

Answer

Send the webhook twice to be sure

Question 16

`subscription.updated` events may arrive out of order. What is a robust receiver design?

Accepted Answer

Use an event version/timestamp to drop stale ones, or fetch current state from the API on each event

Answer

Apply every event in the order it arrives

Answer

Reject events with `500` so they get resent in order

Answer

Assume the provider guarantees ordering

Question 17

With a fixed-window limit of '100 requests per minute', how can a client effectively send 200 requests within seconds?

Accepted Answer

100 at the end of one window and 100 at the start of the next; a sliding window fixes this

Answer

By sending them over HTTP/2, which isn't counted

Answer

By using `HEAD`, which is never limited

Answer

It's impossible; fixed windows are exact

Question 18

An API runs on 20 instances with in-memory rate limiting per instance. What's the problem and common fix?

Accepted Answer

The effective limit becomes up to 20×; use a shared store like Redis with atomic ops (e.g. a Lua script)

Answer

No problem, since the load balancer spreads requests evenly

Answer

Rate limiting must be dropped since it's impossible when distributed

Answer

All requests must be routed to a single instance

Question 19

In a multi-tenant B2B API, what should rate limits primarily be keyed on?

Accepted Answer

The tenant/API key (and per endpoint if needed), so one heavy customer doesn't affect others

Answer

Only the IP address, since all customers have fixed IPs

Answer

A single global limit for the whole API

Answer

The `User-Agent` header value

Question 20

Teams have started writing data transformations and business rules in the API gateway configuration. What is the main risk?

Accepted Answer

The gateway becomes a shared monolith and deployment bottleneck, blurring service ownership

Answer

The gateway can no longer terminate TLS

Answer

Requests stop being encrypted automatically

Answer

No risk; the gateway is the right place for business logic

Question 21

What is the key trade-off of the BFF pattern?

Accepted Answer

Optimized UIs and frontend autonomy versus duplicated logic and more services to operate

Answer

Higher security versus no HTTPS support

Answer

More speed versus no caching possible

Answer

Simplicity versus being unable to use REST

Question 22

With media-type versioning (`Accept: application/vnd.x.v2+json`), what is essential for CDN compatibility?

Accepted Answer

Sending `Vary: Accept` and ensuring the CDN includes `Accept` in the cache key

Answer

Fully disabling HTTPS

Answer

Changing the URL for every version

Answer

Nothing; CDNs consider all headers by default

Question 23

How can a large org prevent accidentally merging breaking changes to REST APIs?

Accepted Answer

Automatically diff the OpenAPI spec against the published one in CI (e.g. oasdiff) and fail PRs on breaking changes

Answer

Relying on human code review alone

Answer

Increasing server-side unit test coverage

Answer

Publishing every change as a new major version

Question 24

In a 40-microservice architecture, why is contract testing often preferred over full E2E testing?

Accepted Answer

E2E is slow, flaky, and needs a full environment; contract tests verify each consumer/provider pair independently and fast

Answer

Contract testing removes the need for any other tests

Answer

E2E cannot detect HTTP errors

Answer

Contract testing measures performance under load

Question 25

In the long-running operation pattern, when `GET /operations/123` reaches completed, what is a conventional response to direct the client to the result?

Accepted Answer

`303 See Other` with `Location` to the result resource (or `200` with a result link in the body)

Answer

`301 Moved Permanently` to the result resource

Answer

`201 Created` on the operation itself

Answer

`410 Gone` because the operation is finished

Question 26

You want to enforce optimistic concurrency so no client overwrites without `If-Match`. What do you return for an unconditional request?

Accepted Answer

`428 Precondition Required`

Answer

`412 Precondition Failed`

Answer

`409 Conflict`

Answer

`400 Bad Request` with no explanation

Question 27

What does Hyrum's Law say about APIs?

Accepted Answer

With enough users, every observable behavior will be depended on by somebody, regardless of the contract

Answer

Every API must be rewritten after two years

Answer

The number of endpoints should scale with the square root of users

Answer

API latency scales linearly with its field count

Question 28

Why is HATEOAS rarely adopted in public APIs even though it's part of REST's original definition?

Accepted Answer

Most clients are hardcoded for a specific UI and don't discover links dynamically; payload and tooling costs outweigh benefits

Answer

HATEOAS is incompatible with JSON and works only with XML

Answer

HATEOAS requires HTTP/3

Answer

HATEOAS severely weakens API security

Question 29

Why is `OFFSET 1000000 LIMIT 20` slow on a large table?

Accepted Answer

The database must scan and discard a million rows to reach the 20

Answer

Because a LIMIT under 100 causes a full table lock

Answer

Because OFFSET only works on string columns

Answer

Because the result must be gzipped before sending

Question 30

Returning `totalCount` on every list response over a table with hundreds of millions of rows is causing problems. Best approach?

Accepted Answer

Make the count opt-in or approximate, and rely on `hasNextPage` for navigation

Answer

Keep running an exact `SELECT COUNT(*)` on every request

Answer

Remove pagination so no count is needed

Answer

Compute the count client-side by downloading every row

Question 31

Cursor pagination on `ORDER BY price` sometimes skips or repeats items. Why?

Accepted Answer

`price` isn't unique; a unique tie-breaker like `id` must be added to the sort and cursor

Answer

Cursors only work with date columns

Answer

The database must run in read-uncommitted mode

Answer

You should use `ORDER BY RANDOM()` instead

Question 32

Customers want to import 500,000 records through the API. Which design scales best?

Accepted Answer

Upload a file/batch to an async job (`202` + status resource) with per-row error reporting

Answer

One synchronous `POST` with all records and a ten-minute timeout

Answer

500,000 separate `POST` requests with no limits

Answer

Send the records in the query string of a `GET`

Question 33

In a chain A→B→C, each layer retries 3 times. When C slows down, what happens and what's the fix?

Accepted Answer

Load on C amplifies up to 27×; retry at one layer only and use retry budgets and circuit breakers

Answer

Nothing, since retries run in parallel

Answer

C auto-scales and the problem is solved

Answer

Raise retries to 10 at each layer

Question 34

A client has a 2-second deadline and the request passes through three services. Why should the deadline be propagated?

Accepted Answer

So downstream services stop useless work once the client gives up and respect the remaining time budget

Answer

Because the TLS handshake fails without it

Answer

So responses get cached in the CDN

Answer

Because protobuf can't be decoded without a deadline

Question 35

Which requests can a gateway/proxy safely auto-retry after a connection reset?

Accepted Answer

Requests with idempotent methods (`GET`, `PUT`, `DELETE`) or ones carrying an idempotency key

Answer

All requests including key-less `POST`

Answer

Only requests without a body, regardless of method

Answer

Only `POST` requests, since they're usually most important

Question 36

A server echoes the `Origin` header unchecked into `Access-Control-Allow-Origin` with `Allow-Credentials: true`. What's the risk?

Accepted Answer

Any malicious site can make requests with the user's cookies and read sensitive responses

Answer

No risk, because the browser already verified the origin

Answer

It only makes preflights slower

Answer

The server can no longer read cookies

Question 37

An SPA on `app.example.com` calls an API on `api.example.com`, and preflights add notable latency. What's an architectural fix?

Accepted Answer

Serve the API from the same origin via a reverse proxy or BFF (e.g. `app.example.com/api`)

Answer

Disable CORS in users' browsers

Answer

Convert all requests to `GET` with the token in the URL

Answer

Use `Access-Control-Allow-Origin: *` with credentials

Question 38

Users opening several tabs find new requests hang. The app uses SSE over HTTP/1.1. Likely cause?

Accepted Answer

The ~6 concurrent connections per origin limit in HTTP/1.1; each SSE holds one. HTTP/2 solves this

Answer

SSE only works in one tab per browser

Answer

The server closes the connection after 6 events

Answer

`EventSource` cancels all `fetch` requests

Question 39

A WebSocket chat runs on 10 nodes and users in one room are connected to different nodes. How do messages reach everyone?

Accepted Answer

A pub/sub backplane (Redis Pub/Sub, NATS, Kafka) that fans messages out across nodes

Answer

Sticky sessions alone suffice and messages reach all nodes automatically

Answer

The load balancer copies WebSocket messages between nodes

Answer

Each client connects to all 10 nodes simultaneously

Question 40

The browser `WebSocket` API doesn't allow setting an `Authorization` header. Which approach is safer?

Accepted Answer

Fetch a short-lived single-use ticket from the API and present it on connect, plus check the `Origin` header

Answer

Put a long-lived access token in the query string permanently

Answer

Connect without authentication and trust the user's IP

Answer

Authenticate only once at user signup

Question 41

For very high-traffic internal microservice communication with polyglot teams, why is gRPC often chosen?

Accepted Answer

Strongly typed contracts with multi-language codegen, efficient binary serialization, and streaming over HTTP/2

Answer

Because gRPC responses are easily cached by CDNs and browsers

Answer

Because it's easier to debug with curl than REST

Answer

Because browsers support it natively

Question 42

Which scenario is the strongest case for choosing GraphQL over REST?

Accepted Answer

Many diverse clients (web, iOS, Android) with different data needs aggregating from several services

Answer

A simple API for uploading and downloading large files

Answer

A public read-heavy API relying on aggressive CDN caching

Answer

Ultra-low-latency internal service-to-service calls

Question 43

A developer shares one global DataLoader instance across all requests for performance. What's the serious problem?

Accepted Answer

Its cache is shared across users; data can go stale or leak to other users bypassing authorization

Answer

A global DataLoader disables batching entirely

Answer

Node.js doesn't allow global objects

Answer

No problem; it's the recommended approach

Question 44

Why do some teams model mutation business errors as union types (e.g. `CreateUserResult = User | EmailTaken`) rather than the `errors` array?

Accepted Answer

Expected errors become typed and discoverable in the schema, leaving `errors` for unexpected failures

Answer

Because the `errors` array is deprecated in the GraphQL spec

Answer

Because union types serialize responses faster

Answer

Because the `errors` array only works over WebSocket

Question 45

An attacker brute-forces passwords with one GraphQL request containing 1000 aliases of a `login` mutation, bypassing per-request rate limits. Right defense?

Accepted Answer

Limit aliases/operations per request and rate-limit at the resolver or cost level

Answer

Disable HTTPS for the GraphQL endpoint

Answer

Increase the maximum request body size

Answer

Turn the `login` mutation into a query

Question 46

Why must servers use strong ETags rather than weak ones for `If-Match`?

Accepted Answer

`If-Match` uses strong comparison; a weak ETag means only semantic equivalence and never matches

Answer

Because weak ETags aren't supported in HTTP/2

Answer

Because weak ETags are generated and understood only by CDNs

Answer

Because strong ETags carry a cryptographic signature

Question 47

What behavior does `Cache-Control: max-age=60, stale-while-revalidate=300` produce?

Accepted Answer

Fresh for 60s; for 5 minutes after, the stale copy is served instantly while revalidating in the background

Answer

Cached for 300s, then unavailable for 60s

Answer

The client must synchronously revalidate every 60s and wait

Answer

The stale copy is used only when the server errors

Question 48

To retire v1 of a public API with thousands of consumers, which process is most professional?

Accepted Answer

Announce with `Deprecation`/`Sunset`, track per-client usage, contact users directly, run scheduled brownouts, then remove

Answer

Remove it abruptly in one release and handle support tickets

Answer

Keep v1 forever without any announcement

Answer

Silently change v1's behavior to match v2

Question 49

When can adding a new `REFUNDED` value to a response `status` enum be breaking?

Accepted Answer

When clients exhaustively switch on known values or treat unknown values as errors

Answer

Never; adding an enum value is always safe

Answer

Only if the value is written in uppercase

Answer

Only when the API is served over HTTP/1.1

Question 50

Why is `PATCH` not guaranteed idempotent by the spec?

Accepted Answer

Because some patch ops, like a JSON Patch `add` to `/items/-` (append to array), have a new effect on each repeat

Answer

Because `PATCH` always creates a new resource

Answer

Because `PATCH` cannot carry a body

Answer

Because `PATCH` is a safe method