How to Use This Guide

These are the API Testing interview questions that appear most frequently in real interviews.

Each answer provides a concise explanation suitable for interview revision. For complete explanations, examples, and practical demonstrations, refer to the linked tutorial.

For the complete learning path, begin with the Complete API Testing Guide.

Advertisement

API Fundamentals (Q1–6)

Q1. What is an API?

An API is an interface that allows two applications to communicate.

The client sends a request, and the server processes it and returns a response.

Learn more: Fundamentals

Q2. What is API Testing and why is it important?

API Testing validates business logic and data at the service layer without involving the user interface.

It is faster, more reliable, and detects issues earlier than UI testing.

Learn more: Fundamentals

Q3. What are the different types of APIs?

Common API types include:

  • REST
  • SOAP
  • GraphQL
  • gRPC

Learn more: Fundamentals

Q4. What is the difference between REST and SOAP?

  • REST is a lightweight architectural style that commonly exchanges JSON data.
  • SOAP is a strict XML-based protocol that supports stateful operations.

Learn more: REST vs SOAP

Q5. What are the types of API Testing?

Common API testing types include:

Learn more: Fundamentals

Q6. Why is Postman used?

Postman is a graphical tool used to:

  • Build API requests
  • Execute API calls
  • Validate responses
  • Perform manual and exploratory API testing

It can also be executed in CI/CD pipelines using Newman.

Learn more: Fundamentals

HTTP Methods & Status Codes (Q7–13)

Q7. What are the HTTP methods?

The most commonly used HTTP methods are:

  • GET – Retrieve data
  • POST – Create data
  • PUT – Replace data
  • PATCH – Partially update data
  • DELETE – Remove data

Learn more: HTTP Methods

Q8. What is the difference between PUT and PATCH?

  • PUT replaces the complete resource.
  • PATCH updates only the specified fields.

Learn more: GET vs POST vs PUT vs PATCH

Q9. What is idempotency?

Idempotency means sending the same request multiple times produces the same result.

GET, PUT, and DELETE are idempotent.

POST is not.

Learn more: HTTP Methods

Q10. Can GET create a resource?

No.

GET retrieves data and is considered safe and idempotent.

Resource creation should be performed using POST or PUT.

Learn more: HTTP Methods

Q11. What do HTTP status code families represent?

  • 2xx – Success
  • 3xx – Redirection
  • 4xx – Client Errors
  • 5xx – Server Errors

Learn more: Status Codes

Q12. What is the difference between 401 and 403?

  • 401 Unauthorized – Authentication is missing or invalid.
  • 403 Forbidden – Authentication succeeded, but access is not permitted.

Learn more: Status Codes

Q13. What is the difference between 500 and 503?

  • 500 Internal Server Error – A general server-side failure.
  • 503 Service Unavailable – The service is temporarily unavailable or overloaded.

Learn more: Status Codes

Requests & Responses (Q14–18)

Q14. What is an API endpoint?

An endpoint is the URL through which an API resource is accessed.

Learn more: Requests & Responses

Q15. What are the components of an HTTP request?

A request typically contains:

  • HTTP Method
  • URL / Endpoint
  • Headers
  • Parameters
  • Request Body

Learn more: Requests & Responses

Q16. What are the components of an HTTP response?

An HTTP response contains:

  • Status Code
  • Headers
  • Response Body

Learn more: Requests & Responses

Q17. What is the difference between Path Parameters and Query Parameters?

  • Path Parameters identify a specific resource.
  • Query Parameters modify or filter the request.

Learn more: Requests & Responses

Q18. What are HTTP request headers used for?

Headers carry metadata such as:

  • Content-Type
  • Authorization
  • Accept

Learn more: Requests & Responses

Data Formats (Q19–21)

Q19. What is JSON and why is it used?

JSON is a lightweight key-value data format that is easy to read and parse.

It is the default format used by most REST APIs.

Learn more: Data Formats

Q20. What is the difference between JSON and XML?

  • JSON is lightweight and easy to parse.
  • XML is more verbose and has a stricter structure.

SOAP uses XML exclusively.

Learn more: Data Formats

Q21. What is the difference between JSON and JSON Schema?

  • JSON contains the actual data.
  • JSON Schema defines the expected structure and data types for validation.

Learn more: Data Formats

Authentication (Q22–25)

Q22. What are the different API authentication methods?

Common authentication methods include:

  • No Authentication
  • Basic Authentication
  • API Key
  • Bearer Token
  • OAuth 2.0
  • JWT

Learn more: Authentication

Q23. What is the difference between Authentication and Authorization?

  • Authentication verifies who the user is.
  • Authorization determines what the authenticated user is allowed to access.

Learn more: Authentication

Q24. What is JWT?

JWT (JSON Web Token) is a signed token format that carries user claims and is commonly sent in the Authorization header.

Learn more: Authentication

Q25. How do you test authentication failures?

Validate:

  • Expected 401 or 403 status codes
  • Error response schema
  • Expired token behavior
  • Invalid token behavior

Learn more: Authentication

Postman & Scripting (Q26–28)

Q26. What are Postman variables and their scopes?

Common variable scopes include:

  • Global
  • Collection
  • Environment
  • Local

They help eliminate hardcoded values and simplify environment switching.

Learn more: Postman Essentials

Q27. How do you write assertions in Postman?

Assertions are written in the Tests tab using JavaScript and Chai assertions.

Examples include response status and response body validations.

Learn more: Postman Scripting

Q28. What is API chaining?

API chaining passes data from one request to another.

A value is extracted from one response, stored as a variable, and reused in subsequent requests.

Learn more: Postman Scripting

Advanced & CI/CD (Q29–30)

Q29. What is a Mock Server and when is it used?

A Mock Server simulates an API when the actual backend service is unavailable.

It allows development and testing to continue before the real API is ready.

Learn more: Advanced API Testing

Q30. How do you execute Postman tests in CI/CD?

Execute Postman collections using Newman.

Newman integrates with Jenkins and other CI/CD tools, generates reports, and can fail the build when API tests fail.

Learn more: Error Handling & CI/CD

Next Steps

Continue your API Testing interview preparation with:

  • Complete API Testing Guide
  • Complete REST Assured Guide
  • API Testing Practical (Postman) Series
  • SDET Interview Guide