Web API & REST Interview Questions and Answers

Web API interview questions — REST principles, HTTP verbs and status codes, content negotiation, model binding, versioning, filters and securing APIs.

Start with the top questions Browse all questions

Web API & REST

34Questions

7Topics

Basic to AdvancedDifficulty

Fresher to 5+ YrsExperience

All Web API & REST Questions (34) Sort by

01 What is the difference between IActionResult, ActionResult<T> and returning T directly? Return T directly for the simplest case — the framework serialises it as 200. Return IActionResult when the action… ASP.NET Core APIs Intermediate 2–3 Yrs
02 What is ProblemDetails, and why use it for API errors? ProblemDetails is a standardised JSON error format (RFC 7807 / 9457) with fields like type, title, status, detail,… ASP.NET Core APIs Intermediate 2–3 Yrs
03 How do you make a POST endpoint safe to retry? Have the client send an idempotency key (a unique GUID per logical operation) in a header. The server records the key… API Design Advanced 3–5 Yrs
04 What is the difference between Server-Sent Events and WebSockets? Server-Sent Events — a one-way stream from server to client over plain HTTP (EventSource), simple, auto-reconnecting,… HTTP Advanced 3–5 Yrs
05 What is gRPC, and when would you choose it over REST? gRPC is an RPC framework over HTTP/2 using Protobuf (a compact binary format) with a strict, code-generated contract.… API Design Advanced 3–5 Yrs
06 What is graceful degradation vs progressive enhancement? Progressive enhancement — build the core experience to work with a baseline (server-rendered HTML, no JS), then layer… Architecture Intermediate 2–3 Yrs
07 How do you make a Web API testable? Keep controllers/endpoints thin — bind, delegate to a service or handler, map the result to a status code. The logic… ASP.NET Core APIs Intermediate 2–3 Yrs
08 What is a DTO, and why shouldn't you return EF entities from an API? A DTO (Data Transfer Object) is a plain class that defines exactly the shape of data crossing an API boundary.… API Design Intermediate 2–3 Yrs
09 How do you secure a Web API? Layered: HTTPS everywhere; authenticate every request (JWT bearer, OAuth2, or API keys for service-to-service);… Security Advanced 3–5 Yrs
10 What is CORS, and how do you configure it in ASP.NET Core? CORS (Cross-Origin Resource Sharing) is a browser security mechanism: by default a page can't read responses from a… HTTP Intermediate 1–2 Yrs
11 How do you handle errors and return consistent error responses in a Web API? Use one central exception-handling middleware (or IExceptionHandler in .NET 8) that catches unhandled exceptions and… API Design Intermediate 2–3 Yrs
12 What is idempotency in REST, and how do you make a POST idempotent? An operation is idempotent if performing it once or many times has the same effect. GET, PUT, DELETE are idempotent;… REST Fundamentals Advanced 3–5 Yrs
13 How do you design pagination for a Web API? Accept page/pageSize (or a cursor) as query params, cap pageSize (e.g. 100), and return the items plus metadata —… API Design Intermediate 2–3 Yrs
14 What is content negotiation in Web API? Content negotiation is the server choosing the response format based on the request's Accept header. ASP.NET Core has… HTTP Intermediate 2–3 Yrs
15 What is the difference between PUT and PATCH, and how do you implement PATCH? PUT replaces the whole resource — you send the complete representation, and it's idempotent. PATCH applies a partial… HTTP Intermediate 2–3 Yrs
16 What are the common HTTP status codes an API should use? 2xx: 200 OK, 201 Created (+ Location), 202 Accepted (async), 204 No Content (successful with no body). 4xx (client):… HTTP Basic Fresher
17 What is OpenAPI / Swagger, and why is it useful? OpenAPI is a machine-readable specification that describes an HTTP API — its endpoints, parameters, request/response… API Design Basic 1–2 Yrs
18 What is the difference between 401 Unauthorized and 403 Forbidden? 401 means “you're not authenticated” — no credentials, or invalid/expired ones. The response includes a… Security Basic Fresher
19 What is HATEOAS, and do you need it? HATEOAS (Hypermedia As The Engine Of Application State) means API responses include links to the actions and related… REST Fundamentals Advanced 3–5 Yrs
20 What is the difference between [FromBody], [FromForm], [FromQuery] and [FromRoute]? [FromRoute] — from the URL path template. [FromQuery] — from the query string. [FromBody] — deserialized from the… ASP.NET Core APIs Basic 1–2 Yrs
21 How do you handle a large file upload in an ASP.NET Core API? For small files, IFormFile is fine — it buffers to memory/disk. For large files, stream the multipart request with… ASP.NET Core APIs Advanced 3–5 Yrs
22 What is the difference between REST and gRPC? REST is resource-oriented over HTTP with JSON — human-readable, universally supported, easy to debug. gRPC is… API Design Intermediate 2–3 Yrs
23 What is the Backend-for-Frontend (BFF) pattern? A BFF is a dedicated backend API built for one specific frontend (the web SPA, the mobile app), rather than one… API Design Advanced 3–5 Yrs
24 When should an API use a message queue instead of a synchronous call? Use a queue when the work is slow, can be done later, must not be lost if a downstream is down, or needs to be… API Design Advanced 3–5 Yrs
25 What is response compression, and should the app do it? Response compression (gzip/Brotli) shrinks text responses (JSON, HTML, CSS) based on the client's Accept-Encoding… Performance Intermediate 2–3 Yrs
26 How do you structure a Web API around commands and queries? Queries are safe reads — GET, return a DTO, no side effects. Commands change state — POST/PUT/PATCH/DELETE, often… API Design Advanced 3–5 Yrs
27 What is the ProblemDetails format (RFC 7807 / RFC 9457)? ProblemDetails is a standard JSON shape for HTTP error responses: { type, title, status, detail, instance } with a… API Design Intermediate 2–3 Yrs
28 What is the difference between webhooks and polling? Polling — the client repeatedly asks “anything new?”. Simple, but wasteful and delayed. Webhooks — the server calls… API Design Intermediate 2–3 Yrs
29 What is GraphQL, and how does it compare to REST? GraphQL is a query language for APIs: one endpoint, and the client specifies exactly which fields (across related… API Design Advanced 3–5 Yrs
30 What is a RESTful API? A RESTful API models the system as resources identified by URLs, manipulated with standard HTTP verbs (GET, POST, PUT,… REST Fundamentals Basic Fresher
31 What is the difference between GET, POST, PUT, PATCH and DELETE? GET reads a resource (safe, idempotent, cacheable). POST creates a resource or triggers processing (not idempotent).… HTTP Basic Fresher
32 What is the difference between a Web API controller and an MVC controller? An MVC controller derives from Controller and typically returns a view (HTML) via view/model. A Web API controller… ASP.NET Core APIs Intermediate 2–3 Yrs
33 How do you version a Web API? Pick one scheme and be consistent: URL path (/api/v2/orders) — most visible and cache-friendly; query string… API Design Advanced 3–5 Yrs
34 What are filters in ASP.NET Core MVC/Web API? Filters run code at specific stages of the MVC action pipeline, inside model binding and routing. The types, in order:… ASP.NET Core APIs Intermediate 2–3 Yrs

About these Web API & REST questions

Web API questions test whether you can design an HTTP interface that other teams can consume without surprises. Interviewers want to hear you talk about resources and verbs, correct status codes, idempotency, content negotiation and how you evolve an API without breaking existing clients.

For experienced roles this moves into versioning strategy, pagination and filtering conventions, error-response shape, authentication (JWT/OAuth) and where cross-cutting concerns like validation and logging belong — action filters, middleware or a mediator.

Web API & REST Interview Questions and Answers

No questions match those filters

About these Web API & REST questions