General API Testing Questions
1. What is idempotency in API testing and why is it important?
Answer: Idempotency means performing the same API request multiple times
results in the same state and response. It is crucial for safe retries without
unintended side effects. For example, GET, PUT, and DELETE should be
idempotent.
2. How do you validate API response headers?
Answer: By checking headers like Content-Type, Cache-Control,
Authorization, Set-Cookie to ensure proper metadata is returned. Example:
Content-Type should be application/json for JSON APIs.
3. How do you handle API versioning in your tests?
Answer: Test different API versions separately by using versioned endpoints (e.g.,
/v1/users vs /v2/users) or headers to ensure backward compatibility.
4. What is contract testing in APIs?
Answer: Validating that the API’s request and response structure adheres to a
predefined contract (e.g., OpenAPI/Swagger spec). It prevents breaking changes and
ensures consumer-provider compatibility.
5. How do you test APIs with rate limiting?
Answer: Send requests continuously and verify that after a threshold, the API
returns 429 Too Many Requests. Also, check rate limit headers and retry logic.
6. Explain API pagination testing.
Answer: Verify correct implementation of pagination parameters (page, limit,
offset). Check that data is split correctly across pages and total count matches.
7. How do you test APIs for security vulnerabilities?
Answer: Check for authentication bypass, injection attacks, data exposure,
improper error messages, and validate HTTPS enforcement.
8. How do you validate API latency and performance?
Answer: Measure response times against SLA using tools or scripts. Test under
load for performance degradation and monitor throughput.
9. How do you handle flaky APIs during testing?
Answer: Implement retries, increase timeouts, use circuit breakers, or mock flaky
dependencies during test runs.
10.What is API mocking and when would you use it?
Answer: Creating simulated endpoints that mimic real API responses. Used during
early development or when dependencies are unavailable.
Rabiya Sulthana k | LinkedIn
Postman API Testing Questions
11.How do you use Postman environment variables to manage different API
environments?
Answer: Define variables like {{baseUrl}} in environment configs and switch
environments to run tests against dev, test, or prod easily.
12.How do you write a test in Postman to check if the response time is under
500ms?
Answer:
[Link]("Response time is less than 500ms", function () {
[Link]([Link]).[Link](500);
});
13.How do you handle OAuth2 token refresh in Postman pre-request scripts?
Answer: Write a script to check token expiry and send a refresh token request
before the main API call.
14.How can you run data-driven tests in Postman?
Answer: Use CSV or JSON files in the Collection Runner to iterate over multiple
sets of input data.
15.How do you test response JSON schema in Postman?
Answer:
const schema = {
"type": "object",
"properties": {
"id": {"type": "integer"},
"name": {"type": "string"},
"email": {"type": "string"}
},
"required": ["id", "name", "email"]
};
[Link]('Schema is valid', () => {
[Link](schema);
});
16.How do you chain API requests in Postman?
Answer: Save response data into environment variables and reference them in
Rabiya Sulthana k | LinkedIn
subsequent requests using {{variableName}}.
17.How to test file uploads in Postman?
Answer: Choose form-data body type, add a key with type ‘file’, and upload a
local file.
18.How do you automate Postman tests using Newman in CI/CD?
Answer: Export your collection and run using:
newman run [Link] -e [Link] --reporters cli,junit
19.How do you set global variables in Postman scripts?
Answer:
[Link]("token", "12345");
20.How do you debug Postman tests?
Answer: Use [Link]() in scripts and view logs in Postman Console (View
> Show Postman Console).
21.How do you write a pre-request script to generate a timestamp?
Answer:
[Link]("timestamp", [Link]());
22.How do you test an API for error responses in Postman?
Answer: Send invalid inputs and write test scripts to check status codes and error
message content.
23.How to validate HTTP response headers in Postman tests?
Answer:
[Link]("Content-Type is JSON", () => {
[Link]("Content-Type", "application/json");
});
24.How do you use Postman monitors?
Answer: Schedule automated runs of collections in the cloud to monitor API health
over time.
Rabiya Sulthana k | LinkedIn
25.How do you use Postman mock servers?
Answer: Create mock servers to simulate API responses during front-end
development.
REST Assured API Testing Questions
26.How do you validate JSON response with JSONPath using REST Assured?
Answer:
given()
.when()
.get("/users/1")
.then()
.body("name", equalTo("John"))
.body("age", greaterThan(20));
27.How to set a timeout in REST Assured requests?
Answer:
[Link] = [Link]()
.httpClient([Link]()
.setParam(CoreConnectionPNames.CONNECTION_TIMEOUT, 5000)
.setParam(CoreConnectionPNames.SO_TIMEOUT, 5000));
28.How to send form-data in POST requests using REST Assured?
Answer:
given()
.multiPart("file", new File("path/to/[Link]"))
.formParam("description", "File upload")
.when()
.post("/upload")
.then()
.statusCode(200);
29.How do you handle cookies in REST Assured?
Answer:
Rabiya Sulthana k | LinkedIn
given()
.cookie("session_id", "abc123")
.when()
.get("/dashboard")
.then()
.statusCode(200);
30.How to extract response headers in REST Assured?
Answer:
Headers headers = given()
.when()
.get("/users/1")
.then()
.extract()
.headers();
String contentType = [Link]("Content-Type");
31.How to validate multiple JSON response fields in a single REST Assured
assertion?
Answer:
.then()
.body("name", equalTo("John"),
"email", containsString("@[Link]"),
"age", greaterThan(18));
32.How do you test a PATCH request with REST Assured?
Answer:
given()
.contentType([Link])
.body("{\"age\":31}")
.when()
.patch("/users/1")
.then()
.statusCode(200);
Rabiya Sulthana k | LinkedIn
33.How to use filters in REST Assured for logging or modifying requests?
Answer:
given()
.filter(new RequestLoggingFilter())
.filter(new ResponseLoggingFilter())
.when()
.get("/users");
34.How do you validate response time with REST Assured?
Answer:
.then()
.time(lessThan(2000L));
35.How to deserialize JSON response into a POJO using REST Assured?
Answer:
User user = given()
.when()
.get("/users/1")
.then()
.extract()
.as([Link]);
36.How do you handle HTTPS and SSL in REST Assured?
Answer:
[Link]();
37.How to perform basic authentication with REST Assured?
Answer:
given()
.auth()
.basic("username", "password")
.when()
Rabiya Sulthana k | LinkedIn
.get("/secure")
.then()
.statusCode(200);
38.How to validate XML response using REST Assured?
Answer:
given()
.contentType([Link])
.when()
.get("/xmlEndpoint")
.then()
.body("[Link]", equalTo("success"));
39.How to send headers with REST Assured requests?
Answer:
given()
.header("Authorization", "Bearer token")
.header("Accept-Language", "en-US")
.when()
.get("/users")
.then()
.statusCode(200);
40.How to send query parameters with REST Assured?
Answer:
given()
.queryParam("page", 2)
.queryParam("size", 10)
.when()
.get("/users")
.then()
.statusCode(200);
Rabiya Sulthana k | LinkedIn
41.How to use path parameters in REST Assured?
Answer:
given()
.pathParam("userId", 5)
.when()
.get("/users/{userId}")
.then()
.statusCode(200);
42.How to validate JSON array size in REST Assured?
Answer:
.then()
.body("[Link]()", equalTo(10));
43.How to chain REST Assured requests in Java?
Answer:
Store data from one response and use it in the next:
String token = given()
.auth()
.preemptive()
.basic("user", "pass")
.when()
.post("/login")
.then()
.extract()
.path("token");
given()
.header("Authorization", "Bearer " + token)
.when()
.get("/profile")
.then()
.statusCode(200);
44.How to use REST Assured with TestNG/JUnit for assertions?
Answer: Use TestNG or JUnit assertions alongside REST Assured validations in
Rabiya Sulthana k | LinkedIn
test methods.
45.How do you test DELETE requests in REST Assured?
Answer:
when()
.delete("/users/1")
.then()
.statusCode(204);
46.How do you verify JSON array contains an item with REST Assured?
Answer:
.then()
.body("[Link]", hasItem("John"));
47.How to handle redirects in REST Assured?
Answer:
[Link] =
[Link]().redirect(redirectConfig().followRedirects(true)
);
48.How to use authentication tokens stored in a variable in REST Assured?
Answer:
String token = "abc123";
given()
.header("Authorization", "Bearer " + token)
.when()
.get("/secure")
.then()
.statusCode(200);
49.How to validate nested JSON objects in REST Assured?
Answer:
.then()
Rabiya Sulthana k | LinkedIn
.body("[Link]", equalTo("New York"));
50.How do you send JSON arrays in POST body using REST Assured?
Answer:
String jsonArray = "[{\"name\":\"John\"},{\"name\":\"Jane\"}]";
given()
.contentType([Link])
.body(jsonArray)
.when()
.post("/users/bulk")
.then()
.statusCode(201);
Rabiya Sulthana k | LinkedIn
