Interview Questions and Answers

Common HTTP methods include GET (retrieve data), POST (create data), PUT (update data), DELETE (remove data), and PATCH (partially update data).

HTTP status codes indicate the outcome of an HTTP request. For example, 200 OK indicates success, 404 Not Found indicates a resource was not found, etc.

Postman is an API testing tool that allows testers to send HTTP requests and receive responses. It simplifies the process of testing APIs by providing a user-friendly interface.

Unit testing focuses on testing individual components or functions in isolation, while API testing involves testing the interactions and behavior of the entire API.

API testing involves testing the application programming interfaces (APIs) to ensure they meet functional and performance requirements.

SOAP (Simple Object Access Protocol) is a protocol for exchanging structured information, while REST (Representational State Transfer) is an architectural style based on a set of constraints. RESTful APIs are generally simpler and use standard HTTP methods.

An endpoint is a specific URL where an API can be accessed. It represents the location where the resource can be found or manipulated.

Authentication ensures that the API is accessed by authorized users only. Common authentication methods include API keys, OAuth, and JWT.

Swagger is a tool that helps document and test APIs. It provides a standard way to describe RESTful APIs using a JSON or YAML format.

The 'Authorization' header is used to send credentials (such as API keys or tokens) with an HTTP request, allowing the server to authenticate the user.

Pagination is often handled using parameters like 'page' and 'per_page' in API requests to retrieve a specific subset of data. Testers need to ensure that pagination works correctly.

The 'Content-Type' header specifies the media type of the resource being sent or requested. Common values include 'application/json' and 'application/xml'.

Mocking involves creating simulated responses from an API to test the behavior of an application without making actual calls to the real API. It helps in isolating the testing environment.

Automated API testing offers faster execution, repeatability, broader coverage, and the ability to detect issues early in the development process.

The 'Cache-Control' header specifies caching directives for both requests and responses. It controls how caching is applied to the resource.

Rate limiting restricts the number of API requests a client can make in a given time period. It is used to prevent abuse, ensure fair usage, and maintain system stability.

The 'Accept' header indicates the media types that the client can understand. It helps the server provide an appropriate response format, such as JSON or XML.

Webhooks are HTTP callbacks that allow external systems to be notified in real-time when certain events occur. They are often used for event-driven architectures.

The 'Location' header is used in the HTTP response to provide the URL of the newly created or modified resource, especially in the case of a successful POST request.

API versioning is often done using URL versioning, custom headers, or request parameters. Testers need to ensure that changes in versions do not break existing functionality.

The 'OPTIONS' method is used to describe the communication options for the target resource. It is often used to support cross-origin resource sharing (CORS).

The 'ETag' header provides a mechanism for caching and conditional requests. It represents a unique identifier for a specific version of a resource.

Testing paginated APIs involves verifying that the pagination parameters work correctly, ensuring that the correct number of items is returned per page, and testing the behavior of pagination links.

Data integrity in API testing can be ensured by validating the correctness and consistency of data returned by the API. This includes checking data types, formats, and values.

The 'HEAD' method is similar to GET but returns only the headers and no message body. It is often used to check the status and headers of a resource without fetching the entire content.

Swagger Codegen is a tool that automatically generates server stubs and client libraries from an OpenAPI Specification. It helps in accelerating API development.

The 'Retry-After' header indicates how long the client should wait before making another request. It is often used in the context of rate limiting or when a server is temporarily unavailable.

Security testing for APIs involves checking for vulnerabilities such as injection attacks, data exposure, and unauthorized access. It often includes using tools like OWASP ZAP.

Load testing involves assessing the performance of an API by subjecting it to a specific load, often by simulating multiple concurrent users or requests. It helps identify performance bottlenecks.

A pre-flight request is an HTTP OPTIONS request sent by the browser before the actual request. It checks if the server allows the actual request to be made from the specific origin.