API Testing Interview Questions

🟢 Basic Level (1–20)

1. What is API testing?
2. What is an API?
3. Difference between API and Web Service?
4. What is REST API?
5. What is SOAP API?
6. Difference between REST and SOAP?
7. What are HTTP methods?
8. What is GET method used for?
9. What is POST method used for?
10. What is PUT vs PATCH?
11. What is DELETE method?
12. What is status code in API?
13. What is 200 status code?
14. What is 400 status code?
15. What is 500 status code?
16. What is JSON?
17. What is XML?
18. Difference between JSON and XML?
19. What is endpoint in API?
20. What is request and response?

---

⚙️ Core Concepts (21–40)

21. What tools are used for API testing?
22. What is Postman?
23. What is Swagger?
24. What is API automation testing?
25. What is REST architecture?
26. What is statelessness in REST?
27. What is payload in API?
28. What are headers in API?
29. What is authentication in API?
30. What is authorization?
31. What is Basic Auth?
32. What is Bearer token?
33. What is JWT?
34. What is OAuth?
35. What is API key?
36. What is response time?
37. What is latency?
38. What is caching in API?
39. What is throttling?
40. What is rate limiting?

---

🧪 Testing Concepts (41–60)

41. What is functional API testing?
42. What is load testing in API?
43. What is performance testing?
44. What is negative testing?
45. What is positive testing?
46. What is boundary testing?
47. How do you validate API response?
48. What is schema validation?
49. What is JSON validation?
50. What is error handling in API testing?
51. What is test case design for API?
52. What is regression testing?
53. What is smoke testing?
54. What is sanity testing?
55. What is mock API?
56. What is API mocking tool?
57. What is contract testing?
58. What is integration testing?
59. What is end-to-end testing?
60. What is test automation framework?

---

⚡ Advanced Level (61–80)

61. How does API authentication work?
62. How do you handle dynamic tokens?
63. What is environment in API testing?
64. What is staging vs production API?
65. How do you test API security?
66. What is SQL injection testing in API?
67. What is API versioning?
68. What is backward compatibility?
69. What is idempotent API?
70. Which methods are idempotent?
71. What is async API?
72. What is webhook?
73. What is polling in API?
74. What is GraphQL?
75. GraphQL vs REST?
76. What is API gateway?
77. What is microservices API?
78. What is service virtualization?
79. What is API documentation?
80. What is OpenAPI specification?

---

🚀 Scenario-Based (81–100)

81. How do you test a login API?
82. How do you test a payment API?
83. How do you validate response data?
84. How do you handle authentication failures?
85. How do you test file upload API?
86. How do you test pagination API?
87. How do you test sorting and filtering APIs?
88. How do you test error messages?
89. How do you automate API testing?
90. How do you debug API failures?
91. How do you test third-party APIs?
92. How do you test API performance?
93. How do you test data consistency?
94. How do you test rate limiting?
95. How do you handle flaky APIs?
96. How do you validate response schema?
97. How do you design API test cases?
98. How do you test microservices APIs?
99. How do you integrate API tests in CI/CD?
100. Why is API testing important?

API Testing Answers (1–100)

🟢 Basic (1–20)

1. Testing APIs for functionality, reliability, and performance
2. Application Programming Interface
3. API = interface, Web Service = network-based API
4. REST is lightweight web API architecture
5. SOAP is XML-based protocol
6. REST = simple, SOAP = strict and heavy
7. GET, POST, PUT, PATCH, DELETE
8. Retrieve data
9. Send data to server
10. PUT replaces full resource, PATCH updates part
11. Delete resource
12. Response code from server
13. OK success response
14. Client error
15. Server error
16. Lightweight data format
17. Markup data format
18. JSON is lightweight, XML is verbose
19. API URL where request is sent
20. Request = sent data, Response = received data

---

⚙️ Core (21–40)

21. Postman, SoapUI, RestAssured
22. Tool for API testing
23. API design tool
24. Automated validation of APIs
25. REST = Representational State Transfer
26. No stored session between requests
27. Data sent in request body
28. Metadata sent with request
29. Verifies identity
30. Defines permissions
31. Username-password authentication
32. Token-based authentication
33. Secure token standard
34. Authorization framework
35. API access key
36. Time taken for response
37. Delay in request response
38. Stores frequent responses
39. Limits number of requests
40. Controls request rate

---

🧪 Testing (41–60)

41. Testing API functions
42. Testing system under load
43. Testing speed and stability
44. Testing invalid inputs
45. Testing valid inputs
46. Testing boundary values
47. Compare expected vs actual response
48. Validate structure of response
49. Validate JSON format
50. Handling API errors properly
51. Designing API test scenarios
52. Retesting after changes
53. Basic verification testing
54. Detailed verification testing
55. Simulated API
56. Tool to simulate APIs
57. Testing service contracts
58. Testing combined modules
59. Full system testing
60. Framework to automate API tests

---

⚡ Advanced (61–80)

61. Token/session verification
62. Store and reuse tokens
63. Testing environment setup
64. Testing vs live environment
65. Checking API vulnerabilities
66. Testing malicious SQL input
67. Different API versions
68. Old version support
69. Same result for repeated calls
70. GET, PUT, DELETE
71. Async = non-blocking API
72. Event-based notification
73. Repeated API calling
74. Query-based API language
75. GraphQL = flexible data fetch
76. API traffic manager
77. Multiple small services
78. Simulated service
79. API usage documentation
80. API design specification

---

🚀 Scenario (81–100)

81. Send login request + validate token
82. Validate transaction flow + response
83. Compare response with expected output
84. Check error code and message
85. Upload file + verify storage
86. Check page number response
87. Validate sorting parameters
88. Check error message correctness
89. Use Postman/RestAssured automation
90. Check logs + response codes
91. Mock third-party responses
92. Load testing tools (JMeter, etc.)
93. Compare DB vs API data
94. Check request limit behavior
95. Retry + logging analysis
96. Schema validation tools
97. Positive + negative test cases
98. Microservice integration testing
99. CI/CD pipeline integration
100. Ensures system reliability and correctness