Interview Questions and Answers

RESTful Web API (Representational State Transfer) is an architectural style that uses standard HTTP methods (GET, POST, PUT, DELETE) for communication and relies on stateless, client-server interactions.

Example:

GET /users/1

PUT is used to update or create a resource if it doesn't exist, while POST is used to submit data to be processed to a specified resource.

Example:

PUT /users/1 {"name": "John"}

The DELETE method is used to request the removal of a resource identified by the URI. It is often used to delete a resource on the server.

Example:

DELETE /users/1

CORS (Cross-Origin Resource Sharing) is a security feature implemented by web browsers to restrict webpages from making requests to a different domain than the one that served the original webpage. Web APIs need proper CORS configuration to allow or deny cross-origin requests.

Idempotence means that a given operation will produce the same result regardless of how many times it is executed. In Web APIs, methods like GET, PUT, and DELETE are expected to be idempotent.

The OPTIONS method is used to describe the communication options for the target resource. It is often used to support CORS preflight requests and provide information about the available methods for a resource.

Example:

OPTIONS /users

HTTP status codes indicate the success, failure, or other status of a request. Common codes include 200 OK (success), 404 Not Found (resource not found), and 500 Internal Server Error (server error).

Pagination is the practice of dividing a large set of data into smaller, manageable parts (pages) to improve performance and user experience. It involves using query parameters like 'page' and 'pageSize' in API requests.

Example:

GET /users?page=1&pageSize=10

The HEAD method is similar to GET but without the response body. It is used to retrieve metadata about a resource without transferring the actual data, which can be useful for checking resource availability or obtaining information about the server.

Example:

HEAD /users/1

Stateful communication involves the server remembering the state of the client, while stateless communication treats each request as an independent transaction. RESTful APIs are typically designed to be stateless, with each request containing all the information needed for processing.

PATCH is used to apply partial modifications to a resource. It is typically used when you want to update part of a resource without affecting the entire representation.

Example:

PATCH /users/1 {"name": "UpdatedName"}

SOAP (Simple Object Access Protocol) is a protocol for exchanging structured information in web services, whereas REST is an architectural style. SOAP uses XML for message formatting, while REST commonly uses JSON. RESTful services are generally considered simpler and more scalable.

Rate limiting is a mechanism used to control the number of requests a client can make to an API within a specified time frame. It helps prevent abuse, ensure fair usage, and protect the server from overload.

ETag (Entity Tag) is a mechanism for web caching and conditional requests. It provides a way for the server to tag a resource with a unique identifier, allowing clients to check if the resource has been modified since a certain time.

Content negotiation is the process of selecting the appropriate representation of a resource based on the client's preferences. It involves using headers like 'Accept' and 'Content-Type' to specify the desired format for data exchange.

Middleware refers to software components that can be inserted into the request-response processing pipeline to perform various functions such as authentication, logging, and input validation. It allows developers to customize the behavior of the application.

The 'OPTIONS' method is used to describe the communication options for the target resource. It is often used to support preflight requests in CORS and to provide information about the available methods for a resource.

Example:

OPTIONS /users

Versioning is the practice of managing changes to an API over time. Different approaches include URI versioning (e.g., /v1/users), query parameter versioning (e.g., /users?v=1), header versioning, and content negotiation.

The '406 Not Acceptable' status code is returned when the server cannot produce a response matching the list of acceptable values defined in the 'Accept' header of the request.

Bearer token authentication involves including a token (commonly a JWT) in the 'Authorization' header of the HTTP request. The server validates the token to authenticate the user and authorize the requested action.

Example:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

API documentation serves as a guide for developers on how to use and integrate with an API. It provides information on endpoints, request/response formats, authentication, and examples, making it crucial for developers to understand and implement the API correctly.

An idempotent operation produces the same result whether it is applied once or multiple times. In the context of Web APIs, HTTP methods like GET, PUT, and DELETE are expected to be idempotent, ensuring consistent behavior regardless of the number of requests.

The '204 No Content' status code indicates a successful request, but there is no additional information to send in the response payload. It is commonly used for operations where a response body is not necessary.

The '429 Too Many Requests' status code indicates that the user has sent too many requests in a given amount of time. It is used to prevent abuse and ensure fair usage of the API.

The 'Content-Type' header in requests specifies the media type of the request payload, while the 'Accept' header in requests indicates the media types that are acceptable for the response. These headers play a crucial role in content negotiation between the client and server.

The '401 Unauthorized' status code indicates that the request has not been applied because it lacks valid authentication credentials. It is commonly used when a user needs to authenticate to access a protected resource.