API Testing Interview Questions and Answers
1. What is an API?
An API (Application Programming Interface) is a set of rules that allows one software application to interact
with another.
2. What are the different types of APIs?
REST, SOAP, GraphQL, and RPC are the most common types of APIs.
3. What is the difference between REST and SOAP APIs?
REST is stateless, uses HTTP and JSON, and is lightweight. SOAP is protocol-based, uses XML, and has
strict standards.
4. What are the common HTTP methods used in API testing?
GET, POST, PUT, PATCH, DELETE.
5. What is the difference between PUT and PATCH?
PUT replaces the entire resource, PATCH updates only the specified fields.
6. What is the structure of an HTTP request?
Request line, headers, body, and method.
7. What is the structure of an HTTP response?
Status line, headers, and body.
8. What are status codes in API responses?
They indicate the result of the HTTP request (e.g., 200 OK, 404 Not Found, 500 Internal Server Error).
9. What is Postman and how do you use it for API testing?
Postman is a GUI tool to send requests, inspect responses, and automate tests for APIs.
10. What is the difference between request headers and request body?
Headers contain metadata (e.g., content type), body contains the actual data sent to the server.
11. How do you validate API responses manually?
By checking status codes, response body, headers, and time using tools like Postman.
12. What are the key validations you perform while testing an API?
Status code, response time, data correctness, and headers.
13. What is JSON and how do you validate its content?
JSON (JavaScript Object Notation) is a data format. Validate using key-value pairs and schema.
14. What is schema validation in API testing?
It checks if the JSON response structure matches the expected schema.
15. What is authentication vs authorization in APIs?
Authentication verifies identity, authorization checks access rights.
16. What is Basic Auth, OAuth 2.0, Bearer token, and API key?
Authentication methods: Basic Auth (username/password), OAuth 2.0 (token-based), API Key (unique key in
header).
17. What is the difference between path param and query param?
Path param is part of the URL (e.g., /users/1), query param is key-value (e.g., ?page=2).
18. What is rate limiting in APIs?
Restricts number of API requests in a time period to avoid abuse.
19. How do you handle pagination in APIs?
Using query parameters like page, limit, or offset to retrieve paginated data.
20. What is the use of headers like Content-Type, Accept, Authorization?
To specify the format of request/response and handle secure access.
21. How do you perform API automation using REST Assured?
By writing Java code with REST Assured methods like given(), when(), then().
22. What are some commonly used methods in REST Assured?
get(), post(), put(), delete(), then().statusCode(), body().
23. How do you validate the status code, headers, and body in REST Assured?
Using assertions in the then() block of REST Assured.
24. How do you pass query parameters, path parameters, and headers in REST Assured?
Using queryParam(), pathParam(), and header() methods.
25. How do you send POST requests with JSON payload in REST Assured?
By setting contentType to JSON and passing body as a string or object.
26. What are assertions in REST Assured and how do you write them?
Assertions verify expected outcomes. Example: then().statusCode(200).
27. How do you handle request/response logging in REST Assured?
Using log().all() or log().body() etc. to print request and response.
28. How do you chain requests (e.g., extract token and pass to next call)?
Use extract().path() to save data from one request and reuse it in the next.
29. What is serialization and deserialization in API testing?
Serialization = Java object -> JSON, Deserialization = JSON -> Java object.
30. How do you integrate REST Assured tests with TestNG or JUnit?
By writing REST Assured code inside @Test methods and running them with the framework.
31. Have you worked on any API automation framework?
Yes, using TestNG + REST Assured + Maven + reporting tools like ExtentReports.
32. How do you manage test data for API testing?
Using JSON files, Excel, property files, or data providers.
33. What are some real-time challenges you've faced in API testing?
Auth failures, unstable environments, schema mismatches, slow responses.
34. How do you test negative scenarios in API testing?
By sending invalid data, missing headers, or unauthorized requests.
35. What tools have you used apart from Postman and REST Assured?
Swagger, SOAP UI, JMeter, Charles Proxy, Insomnia.
