API Testing Interview Questions (2026)
API testing interview questions check whether you can verify endpoints, contracts, status codes, auth, request validation, data state, errors, performance signals, and security risk.
45 questions with answers- What Is API Testing?
- All Questions on This Page
- API Testing Fundamentals
- API Testing Practical Interview Questions
- API Testing Advanced Scenarios
- API Testing vs UI Testing vs Contract Testing
- How to Prepare for a API Testing Interview
- What Strong API Testing Answers Prove
- API Testing Quiz
- Frequently Asked Questions
What Is API Testing?
Key Takeaways
- ✓API testing checks whether an endpoint returns the right status, body, headers, errors, auth behavior, and side effects.
- ✓Strong answers mention contracts, schema validation, negative cases, idempotency, pagination, rate limits, and security risk.
- ✓API tests often give faster and more stable regression evidence than browser-only tests.
- ✓Postman is common for manual and automated API checks, while REST Assured and similar libraries are common in code-based suites.
API testing verifies the behavior of application programming interfaces without depending on the full user interface. In interviews, you are judged on whether you understand HTTP methods, status codes, request payloads, response validation, authentication, authorization, contracts, data side effects, and negative cases. A strong answer shows exactly what you would send, what you expect back, and how you know the API did the right thing.
Watch: Postman Beginner's Course: API Testing
Video: Postman Beginner's Course: API Testing (freeCodeCamp.org, YouTube)
Test yourself and earn a certificate
6 quick questions. Score 70%+ to download your API Testing certificate.
All Questions on This Page
45 questions- 1. What is API testing?
- 2. Which HTTP methods matter in API testing?
- 3. How do you explain HTTP status codes in interviews?
- 4. What headers do API testers check?
- 5. What do you validate in a request payload?
- 6. What do you validate in a response body?
- 7. What is schema validation?
- 8. What is OpenAPI used for in testing?
- 9. What is contract testing?
- 10. How do you test API authentication?
- 11. How is authorization different from authentication?
- 12. What is idempotency in API testing?
- 13. What do you test in paginated APIs?
- 14. What is rate-limit testing?
- 15. Which API security risks should testers know?
- 16. How do you test a GET endpoint?
- 17. How do you test a POST endpoint?
- 18. How do you test PUT vs PATCH?
- 19. How do you test DELETE?
- 20. What negative API tests do you write?
- 21. How do you test authorization for APIs?
- 22. How do you test pagination?
- 23. How do you test filters?
- 24. How do you test sorting?
- 25. What makes a good API error response?
- 26. How do you find contract drift?
- 27. How do you run API tests in CI?
- 28. When do you use a pre-request script?
- 29. How do you set up API test data?
- 30. What basic performance checks can API testers include?
- 31. An API returns 200 but wrong data. Is the test passed?
- 32. Invalid input returns 500. What is wrong?
- 33. Why test missing token if valid token works?
- 34. User A can fetch User B's order by changing ID. What is this?
- 35. Records appear twice across pages. What do you inspect?
- 36. A field name changes without notice. What kind of test catches it?
- 37. A critical API becomes slow. What do you collect?
- 38. An error response exposes stack trace. What do you report?
- 39. Double-click causes duplicate orders. What API concept helps?
- 40. The API sends JSON but header says text/plain. Why does it matter?
- 41. API tests pass only when run in a fixed order. What is the issue?
- 42. An API depends on a third party that times out. What should tests check?
- 43. An API bug appears only in production. What do you compare?
- 44. A Postman collection has outdated variables. What do you improve?
- 45. What makes an API testing answer senior?
API Testing Fundamentals
Foundational15 questionsStart here. These are the definitions and first-principle checks that open most rounds.
Q1. What is API testing?
API testing verifies endpoint behavior through requests and responses rather than full UI flows.
It checks status, body, headers, auth, errors, contracts, and side effects.
API testing changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Watch a deeper explanation
Video: Learn Postman for API Testing (Valentin Despa, YouTube)
Q2. Which HTTP methods matter in API testing?
Common methods include GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS.
Know the expected behavior and idempotency of each method.
HTTP methods changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q3. How do you explain HTTP status codes in interviews?
Status codes describe the result class: 2xx success, 3xx redirection, 4xx client error, and 5xx server error.
A strong tester also checks the right code for the exact case.
status codes changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q4. What headers do API testers check?
API testers check content type, cache, auth, correlation ID, rate-limit, CORS, security, and pagination headers where relevant.
Headers often carry behavior not visible in the body.
headers changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
| Answer part | What to say | Evidence to mention |
|---|---|---|
| Definition | headers in one direct sentence. | Official docs or course material |
| Use case | The work where it changes a decision. | Dataset, model, query, dashboard, or pipeline |
| Risk | What breaks when it is misunderstood. | Metric, log, test result, or review note |
Q5. What do you validate in a request payload?
Validate required fields, optional fields, types, formats, boundaries, nulls, arrays, nested objects, and unknown fields.
Bad payload tests catch many backend defects.
request payload changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Watch a deeper explanation
Video: Postman API Test Automation for Beginners (Valentin Despa, YouTube)
Q6. What do you validate in a response body?
Validate fields, values, types, schema, ordering, totals, messages, IDs, timestamps, and business rules.
Don't only check that the response is present.
response body changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q7. What is schema validation?
Schema validation checks whether a JSON or XML response matches an expected structure and data types.
It catches missing, renamed, or wrong-type fields early.
schema validation changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
pm.test('response has required fields', () => {
const body = pm.response.json();
pm.expect(body).to.have.property('id');
pm.expect(body.email).to.match(/@/);
});Q8. What is OpenAPI used for in testing?
OpenAPI describes endpoints, methods, parameters, request bodies, responses, and auth in a machine-readable contract.
Testers can use it to design cases and catch contract drift.
OpenAPI changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q9. What is contract testing?
Contract testing verifies that API providers and consumers agree on request and response expectations.
It helps detect breaking changes before deployment.
contract testing changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q10. How do you test API authentication?
Test valid token, missing token, expired token, malformed token, wrong scope, and revoked credentials.
Authentication proves identity.
authentication changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q12. What is idempotency in API testing?
Idempotency means repeating the same request has the same effect as sending it once.
GET, PUT, and DELETE are commonly expected to be idempotent; POST may need idempotency keys for payments.
idempotency changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q13. What do you test in paginated APIs?
Test limit, offset or cursor, next links, total counts, sorting stability, empty pages, and invalid page values.
Pagination bugs often create missing or duplicate records.
pagination changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Watch a deeper explanation
Video: Postman API Testing Tutorial (The Testing Academy, YouTube)
Q14. What is rate-limit testing?
Rate-limit testing checks whether APIs control request volume and return clear errors when limits are exceeded.
Expect codes such as 429 with helpful retry information when implemented.
rate limiting changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q15. Which API security risks should testers know?
Know broken object-level authorization, broken authentication, excessive data exposure, lack of rate limits, and unsafe business flows.
Security cases should be part of API negative testing.
OWASP API risks changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
API Testing Practical Interview Questions
Intermediate15 questionsThese questions test whether you can apply the topic to real data, real code, and messy constraints.
Q16. How do you test a GET endpoint?
Check status, body schema, field values, filters, sorting, pagination, auth, cache headers, and not-found behavior.
Also check whether the endpoint leaks fields the user shouldn't see.
test GET endpoint changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q17. How do you test a POST endpoint?
Check valid create, required fields, invalid types, duplicates, boundaries, auth, response location or ID, and follow-up GET.
Verify the side effect, not only the response.
test POST endpoint changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
pm.test('created user has id', () => {
pm.response.to.have.status(201);
const user = pm.response.json();
pm.expect(user.id).to.be.a('string');
pm.collectionVariables.set('userId', user.id);
});Q18. How do you test PUT vs PATCH?
PUT usually replaces a resource, while PATCH partially updates it. Test omitted fields, null values, and unchanged fields.
Ask the API contract what behavior is intended.
test PUT and PATCH changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q19. How do you test DELETE?
Check delete success, repeated delete, follow-up GET, permission, soft-delete rules, audit trail, and dependent data behavior.
Confirm whether delete is physical or logical.
test DELETE endpoint changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q20. What negative API tests do you write?
Send missing fields, wrong types, invalid formats, boundary values, extra fields, bad JSON, invalid IDs, and unsupported methods.
Errors should be clear and safe.
test negative input changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q21. How do you test authorization for APIs?
Use users with different roles and object ownership, then check allowed, blocked, cross-tenant, and direct-object access.
Object-level authorization is a common API risk.
test auth changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q22. How do you test pagination?
Check first page, middle page, last page, empty page, invalid limits, stable sort, duplicate records, and missing records.
Use known data so counts can be verified.
test pagination changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q23. How do you test filters?
Use exact matches, partial matches, multiple filters, invalid values, empty results, date ranges, and special characters.
Filters often interact with pagination and sorting.
test filtering changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q24. How do you test sorting?
Check ascending, descending, unsupported fields, null values, duplicate values, and stable ordering across pages.
Sorting bugs can hide in repeated values.
test sorting changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q25. What makes a good API error response?
It has the right status, safe message, clear error code, field-level detail where useful, and no sensitive stack trace.
Security and usability both matter.
test error response changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Watch a deeper explanation
Video: API Testing Using Postman Crash Course (Simplilearn, YouTube)
Q26. How do you find contract drift?
Compare actual responses against OpenAPI or consumer expectations, then flag missing, renamed, or changed fields.
Contract drift breaks clients even when backend tests pass.
test contract drift changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q27. How do you run API tests in CI?
Run collections or code tests against a known environment, inject secrets safely, publish reports, and fail on real defects.
Separate environment failure from API failure.
run collection in CI changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q28. When do you use a pre-request script?
Use it to set dynamic variables such as timestamp, nonce, token, or request signature before sending the request.
Keep scripts readable and avoid hiding test logic.
write Postman pre-request script changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
pm.collectionVariables.set('requestTime', new Date().toISOString());Q29. How do you set up API test data?
Use setup APIs, fixtures, seed scripts, or isolated test tenants, then clean up or expire data after the run.
Known data makes assertions meaningful.
test data setup changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q30. What basic performance checks can API testers include?
Track response time, payload size, timeout behavior, concurrency, and rate-limit behavior for critical endpoints.
For formal load testing, use dedicated performance tools.
test performance signal changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
API Testing Advanced Scenarios
Advanced15 questionsAdvanced rounds test trade-offs, failure modes, and whether the decision can hold up under production pressure.
Q31. An API returns 200 but wrong data. Is the test passed?
No. Status code is only one check. Validate body, business rule, and side effect.
A correct API response must be semantically correct.
200 but wrong data changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q32. Invalid input returns 500. What is wrong?
Client-side bad input should usually return a 4xx error with a safe message.
A 500 suggests the server didn't handle the case cleanly.
500 on invalid input changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q33. Why test missing token if valid token works?
Because access control is a separate behavior. Valid auth doesn't prove denied access works.
Security bugs often live in negative auth cases.
missing auth test changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q34. User A can fetch User B's order by changing ID. What is this?
It is broken object-level authorization.
Report it as a serious API security issue.
cross-user access changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q35. Records appear twice across pages. What do you inspect?
Check sort stability, cursor handling, data changes during paging, and limit or offset logic.
Stable ordering matters for paging.
pagination duplicates changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q36. A field name changes without notice. What kind of test catches it?
Schema validation or contract testing catches renamed or missing fields.
Consumers may break even when status is 200.
schema changed changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q37. A critical API becomes slow. What do you collect?
Collect endpoint, method, payload, response time distribution, data size, environment, and recent changes.
One average number is not enough.
slow endpoint changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q38. An error response exposes stack trace. What do you report?
Report sensitive error leakage and attach request, response, and environment.
Error messages should help clients without revealing internals.
unsafe error changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q39. Double-click causes duplicate orders. What API concept helps?
Idempotency keys or duplicate request protection.
This is common in payments and order creation.
duplicate POST changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q40. The API sends JSON but header says text/plain. Why does it matter?
Clients may parse incorrectly or reject the response.
Headers are part of the contract.
wrong content type changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q41. API tests pass only when run in a fixed order. What is the issue?
Tests share hidden state.
Make setup explicit or isolate data.
test depends on order changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q42. An API depends on a third party that times out. What should tests check?
Check timeout handling, retry rules, fallback behavior, error response, and logging.
The API should fail predictably.
third-party timeout changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q43. An API bug appears only in production. What do you compare?
Compare config, data volume, auth provider, rate limits, dependency versions, network, and feature flags.
Environment parity matters.
production-only API bug changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q44. A Postman collection has outdated variables. What do you improve?
Clean environments, name variables clearly, remove stale requests, and add collection-level docs and tests.
Collections need maintenance like code.
collection maintenance changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
Q45. What makes an API testing answer senior?
It covers contract, auth, data, side effects, negative cases, observability, and risk without stopping at 200 OK.
Senior candidates test behavior and failure modes.
senior API tester changes API Testing decisions by affecting the chosen method, the failure mode, or the validation step. Reliable evidence comes from a metric, test result, query output, log, or review note.
API Testing vs UI Testing vs Contract Testing
API testing sits between low-level unit checks and full UI journeys. It is often the best layer for business rules, error behavior, and integration contracts.
| Testing type | Checks | Best for | Common miss |
|---|---|---|---|
| API testing | Endpoint behavior, status, body, headers, side effects | Business rules and integration paths | Browser rendering and UX |
| UI testing | End user journey through screens | Critical flows and browser behavior | Fast backend coverage |
| Contract testing | Provider and consumer agreement | Breaking change detection | Real data side effects |
| Security testing | Auth, access control, abuse cases | API exposure risk | Normal happy-path behavior |
API testing interview scoring weight
Tools matter, but protocol thinking matters more.
Scale: Hyring editorial score for interview preparation, not an external benchmark.
- HTTP basics: methods, codes, headers
- Validation: body, schema, side effects
- Negative cases: bad input and auth
- Postman tool use: collections and scripts
How to Prepare for a API Testing Interview
Prepare by testing one small API end to end. Write requests for create, read, update, delete, invalid input, missing auth, wrong role, pagination, and rate limit behavior.
- Know HTTP methods, status code families, headers, query params, path params, body payloads, and content types.
- Practice Postman collections, environments, variables, pre-request scripts, tests, and collection runs.
- Review OpenAPI, JSON Schema, auth, idempotency, pagination, filtering, sorting, and error responses.
- One example where an API test caught a bug faster than UI testing would have is useful.
API testing coverage flow
A good API answer validates both the response and the side effect.
What Strong API Testing Answers Prove
A strong API testing answer shows request thinking, validation depth, and risk awareness. the key point is more than 'I check 200 OK'.
| Signal | Weak answer | Strong answer |
|---|---|---|
| Status codes | I check status 200. | I check expected success and error codes for each method and failure condition. |
| Body validation | I check response is not empty. | I validate required fields, values, data types, schema, and business rules. |
| Auth | I pass a token. | I test missing token, expired token, wrong role, and object-level access. |
| Side effects | The API returns success. | I verify the created or changed resource through GET, database, or event evidence. |
Test Yourself: API Testing Quiz
Ready to test your API Testing knowledge?
6 questions, about 4 minutes. Score 70% or higher to earn a shareable certificate.
Frequently Asked Questions
What do API testing interviews usually ask?
Is Postman enough for API testing interviews?
What API testing examples should I prepare?
Do API testing roles require coding?
What is the biggest mistake in API testing answers?
Is there an API testing quiz?
Turn API testing answers into interview evidence
Hyring's AI Video Interviewer scores how clearly candidates explain test design, edge cases, and trade-offs. Use this page to practice short API testing answers before the real screen.
Try AI interview prepSources
Written by Adithyan RK