These are the REST Assured questions automation testers and SDETs are asked most often. Each answer is short enough to revise quickly, with Java code for the questions where interviewers expect you to write or explain syntax, and a link to the full tutorial. For the complete learning path, start with The Complete REST Assured Tutorial.

The examples assume these static imports, which every REST Assured test uses:

import static io.restassured.RestAssured.given;
import static org.hamcrest.Matchers.*;

Fundamentals (Q1–5)

Q1. What is REST Assured?

An open-source Java library for testing and automating REST APIs. It provides a readable, BDD-style syntax for sending HTTP requests and validating responses, and it plugs into Maven, TestNG or JUnit, and CI tools like Jenkins. See also: Practice REST Assured CI/CD, Contract & Senior Tasks.

Learn more: REST Assured Fundamentals

Q2. Why is REST Assured used?

  • Code-based API automation that lives in the same project as UI tests.
  • Readable given/when/then syntax.
  • Built-in JSON and XML path support, Hamcrest matchers and schema validation.
  • Easy integration with Maven, TestNG and Jenkins.

Q3. What is a RESTful web service?

A service that follows REST principles: client–server separation, stateless requests, a uniform interface (resources identified by URLs and manipulated with HTTP methods), cacheable responses and a layered system. Most REST APIs exchange JSON.

Q4. What is the difference between REST and SOAP?

REST is an architectural style that usually uses JSON over plain HTTP and is lightweight. SOAP is a strict protocol that uses XML envelopes and formal contracts (WSDL). REST Assured can test both, but is mainly used for REST.

Learn more: REST vs SOAP

Q5. When should you use REST Assured instead of Postman?

Postman suits manual and exploratory testing. REST Assured suits scalable, code-based regression frameworks with reusable specifications, POJOs and CI integration.

Learn more: REST Assured vs Postman

Advertisement

Setup & Syntax (Q6–9)

Q6. Which Maven dependency does REST Assured need?

<dependency>
    <groupId>io.rest-assured</groupId>
    <artifactId>rest-assured</artifactId>
    <version>5.5.0</version>   <!-- or the latest 5.x -->
    <scope>test</scope>
</dependency>

JsonPath and XmlPath come in automatically as transitive dependencies. Add a test framework (TestNG or JUnit), plus json-schema-validator if you validate schemas.

Learn more: Setup & Syntax

Q7. What do given(), when() and then() represent?

  • given() — request setup: base URI, headers, parameters, body, auth.
  • when() — the action: the HTTP method and endpoint.
  • then() — validation: status code, body, headers, time.

Q8. How do you send GET, POST, PUT, PATCH and DELETE requests?

given()
    .baseUri("https://api.example.com")
    .contentType(ContentType.JSON)
    .body("{\"name\": \"Asha\", \"job\": \"SDET\"}")
.when()
    .post("/users")
.then()
    .statusCode(201)
    .body("name", equalTo("Asha"));

Swap .post() for .get(), .put(), .patch() or .delete().

Learn more: Sending Requests

Q9. How do you pass query parameters, path parameters, headers and cookies?

given()
    .pathParam("id", 42)                    // fills {id} in the path
    .queryParam("include", "orders")        // ?include=orders
    .header("X-Request-Id", "test-123")
    .cookie("session", "abc")
.when()
    .get("/users/{id}")
.then()
    .statusCode(200);

A path parameter identifies a resource (/users/42); a query parameter filters or modifies the request (?include=orders).

Validation & Extraction (Q10–15)

Q10. How do you validate the response body?

Inside then(), with Hamcrest matchers and JSON paths:

.then()
    .statusCode(200)
    .body("data.id", equalTo(2))
    .body("data.email", containsString("@"))
    .body("data.roles", hasItems("admin", "tester"))
    .body("data.name", notNullValue());

Learn more: Response Validation

Q11. What is JsonPath, and how do you extract values?

JsonPath is a syntax for navigating JSON (data.users[0].email). Extract a single value with extract().path(), or get a JsonPath object for several:

String firstName = given()
        .when().get("/users/2")
        .then().statusCode(200)
        .extract().path("data.first_name");

Response response = given().when().get("/users");

List<String> emails =
        response.jsonPath().getList("data.email");

Learn more: Logging & Extraction

Q12. How do you validate response time?

.then().time(lessThan(2000L));   // milliseconds

Compare against the agreed SLA. For real performance testing, use a load tool such as JMeter — a single timed request is only a sanity check.

Q13. How do you validate nested JSON and arrays?

Use JSON paths into nested objects, array sizes, and Groovy-style filters:

.body("data.address.city", equalTo("Pune"))
.body("data.orders", hasSize(3))
.body("data.orders.find { it.id == 101 }.status", equalTo("SHIPPED"))
.body("data.orders.amount", everyItem(greaterThan(0)));

Learn more: Advanced Validation

Q14. How do you log requests and responses?

  • .log().all() — log everything (in given() for the request, in then() for the response).
  • .log().ifValidationFails() — log only when an assertion fails, which keeps CI logs readable.

Q15. How do you validate response headers and cookies?

.then()
    .header("Content-Type", containsString("application/json"))
    .cookie("session", notNullValue());

Serialization & Schema Validation (Q16–18)

Q16. What is a POJO, and why use one?

A POJO (Plain Old Java Object) models a JSON payload as a Java class. It makes request bodies reusable, readable and type-safe, and lets you deserialize responses into objects:

public class User {
    private String name;
    private String job;

    public User() {} // needed for deserialisation

    public User(String name, String job) {
        this.name = name;
        this.job = job;
    }

    public String getName() {
        return name;
    }

    public String getJob() {
        return job;
    }
}

// Serialise: Java object → JSON request body
// (needs Jackson or Gson on the classpath)
given()
    .contentType(ContentType.JSON)
    .body(new User("Asha", "SDET"))
.when()
    .post("/users");

// Deserialise: JSON response → Java object
User user = given()
    .when()
    .get("/users/2")
    .then()
    .extract()
    .as(User.class);

Learn more: POJO & Serialization

Q17. What is the difference between serialization and deserialization?

Serialization converts a Java object into JSON (for request bodies). Deserialization converts JSON back into a Java object (for responses). REST Assured uses Jackson or Gson, whichever is on the classpath.

Q18. What is JSON Schema validation?

It checks that a response matches its contract — field names, types and required fields — so you catch breaking API changes early:

import static io.restassured.module.jsv.JsonSchemaValidator.matchesJsonSchemaInClasspath;

given()
    .when()
    .get("/users/2")
.then()
    .body(matchesJsonSchemaInClasspath("schemas/user-schema.json"));

Requires the io.rest-assured:json-schema-validator dependency.

Learn more: JSON Schema Validation

Authentication & API Chaining (Q19–21)

Q19. Which authentication methods have you used?

given().auth().preemptive().basic("user", "pass");        // Basic

given().header(
    "Authorization",
    "Bearer " + token
);                                                       // Bearer token / JWT

given().auth().oauth2(accessToken);                       // OAuth 2.0 access token

given().header("x-api-key", apiKey);                      // API key

Learn more: Authentication in REST Assured

Q20. How do you pass an authentication token?

Call the login API once, extract the token, and reuse it — typically in a request specification:

String token = given()
        .contentType(ContentType.JSON)
        .body("{\"username\": \"qa\", \"password\": \"secret\"}")
    .when()
        .post("/auth/login")
    .then()
        .statusCode(200)
        .extract()
        .path("token");

given()
    .header("Authorization", "Bearer " + token)
.when()
    .get("/orders")
.then()
    .statusCode(200);

Never hard-code tokens or passwords — read credentials from environment variables or a secrets store.

Q21. What is API chaining?

Using a value from one response in the next request — for example, create a user, extract its id, then GET, update and delete that same user. It's how you test end-to-end API workflows.

Learn more: API Chaining, Negative & Data-Driven Practice

TestNG, Negative Testing & Framework Design (Q22–25)

Q22. How does REST Assured integrate with TestNG?

Tests are ordinary TestNG methods: @Test for test cases, @BeforeClass/@BeforeSuite for setup such as getting a token, groups for smoke/regression runs, and @DataProvider for data-driven tests.

Learn more: TestNG Integration · TestNG Cheat Sheet

Q23. How do you do negative API testing?

Send invalid requests and verify the API fails correctly: invalid or missing fields (400), missing or expired token (401), no permission (403), unknown IDs (404), duplicates (409), and wrong methods (405). Check the error message and error schema too — not just the status code.

given()
    .contentType(ContentType.JSON)
    .body("{}")
.when()
    .post("/users")
.then()
    .statusCode(400)
    .body("error", containsString("name is required"));

Learn more: Negative Testing & Error Handling

Q24. How do you design a REST Assured framework?

Typical layers: environment config (base URIs per environment), request and response specifications, API client/service classes, POJOs, test data management, utilities (auth, JSON helpers), tests, and reporting — all run by Maven in CI. Specifications remove duplication:

RequestSpecification requestSpec = new RequestSpecBuilder()
        .setBaseUri(
            System.getProperty(
                "baseUri",
                "https://api.example.com"
            )
        )
        .setContentType(ContentType.JSON)
        .addHeader("Authorization", "Bearer " + token)
        .build();

ResponseSpecification okJson = new ResponseSpecBuilder()
        .expectStatusCode(200)
        .expectContentType(ContentType.JSON)
        .build();

given()
    .spec(requestSpec)
.when()
    .get("/users")
.then()
    .spec(okJson);

Learn more: REST Assured Framework Design

Q25. How do you handle dynamic tokens and flaky APIs?

Generate tokens at runtime (once per suite, refreshing when they expire) instead of hard-coding them. For genuinely eventual-consistency APIs, poll for the expected state with a timeout rather than sleeping; keep test data independent so tests don't collide; and treat retries as a temporary measure while you report the instability.

Learn more: Real-Time Scenarios

Bonus: 3 Quick Follow-Up Questions

How do you upload a file?

given()
    .multiPart(
        "file",
        new File("src/test/resources/resume.pdf")
    )
.when()
    .post("/upload")
.then()
    .statusCode(200);

How do you run the same tests on different environments?

Read the base URI from a system property or config file (mvn test -DbaseUri=https://qa.example.com) and build it into your request specification, as in Q24.

How do you verify data was saved in the database?

After a POST, either GET the resource back, or query the database with JDBC and compare. See SQL for Testers.

How to Prepare

Next Steps

 

From Real Projects

My API experience covers CRUD operations, HTTP methods, JSON path, and validating JSON and XML responses, and my automation work was in Java with TestNG. That combination is exactly what REST Assured builds on: HTTP calls in Java, JSON path for extracting values, and TestNG for running and grouping the tests. If you already know Selenium with TestNG, REST Assured fits into the same project structure. Testsigma supports web, mobile and API test automation, so understanding APIs was part of understanding the product I was testing. Expect at least one question that asks you to write a CRUD test from scratch, including the validation. Further reading: REST Assured Practice.

📖 Related tutorials

📚 Official documentation: REST Assured official site · MDN: HTTP