Top 50 REST API & Web Services Interview Questions & Answers (2026)
Key Takeaways — REST API Interviews in 2026
- •Core Architectural Constraints: A truly RESTful API adheres to 6 Roy Fielding constraints: Client-Server, Statelessness, Cacheability, Layered System, Uniform Interface (HATEOAS), and Code-on-Demand.
- •HTTP Methods & Idempotency:
GET, PUT, DELETE, HEAD, OPTIONSare idempotent (multiple identical requests have the exact same side-effect).POSTis NOT idempotent.PATCHis partially idempotent. - •HTTP Status Code Precision: Distinguish
401 Unauthorized(missing/invalid credentials) vs403 Forbidden(authenticated but lacking permissions), and200 OKvs201 Createdvs204 No Content. - •API Security & Rate Limiting: JWT refresh token rotation, OAuth 2.1 authorization code flow with PKCE, CORS headers, and Token Bucket algorithm rate limiting.
1. REST Principles & Architectural Constraints
REST stands for Representational State Transfer, an architectural style designed by Roy Fielding in 2000.
1. Statelessness
Every request from the client must contain all information needed to process it. No session state is stored on the server.
2. Uniform Interface (HATEOAS)
Resources are uniquely identified via URIs, manipulated through representations (JSON/XML), and include hypermedia links for state transitions.
3. Cacheability
Responses must explicitly define whether they are cacheable using headers like Cache-Control and ETag.
4. Layered System
Clients cannot tell whether they are connected directly to the end server or an intermediary like a proxy or load balancer.
2. HTTP Methods & Idempotency Explained
Idempotency means making the same request N times yields the exact same server-side resource state as making it once.
| Method | Purpose | Safe? | Idempotent? |
|---|---|---|---|
| GET | Retrieve representation of a resource | YES | YES |
| POST | Create a new subordinate resource | NO | NO (creates duplicates) |
| PUT | Replace full resource / create at known URI | NO | YES |
| PATCH | Partially modify fields of a resource | NO | CONDITIONAL |
| DELETE | Remove resource identified by URI | NO | YES |
3. Essential HTTP Status Codes Cheat Sheet
- 200 OK: Standard success response for GET, PUT, PATCH.
- 201 Created: Resource successfully created via POST (includes
Locationheader). - 204 No Content: Action successful, no body returned (common for DELETE).
- 400 Bad Request: Malformed JSON or validation errors.
- 401 Unauthorized: Authentication credentials missing or invalid.
- 403 Forbidden: Authenticated successfully, but client lacks permission.
- 404 Not Found: Resource URI does not exist.
- 409 Conflict: Request conflicts with current resource state (e.g. duplicate email).
- 429 Too Many Requests: Rate limit exceeded.
- 500 Internal Server Error: Unhandled runtime exception on server.
- 503 Service Unavailable: Server overloaded or undergoing maintenance.
4. REST vs GraphQL vs gRPC: When to Use What
| Protocol | Strengths | Best For |
|---|---|---|
| REST | Universal HTTP standard, cacheable at CDN level, simple debugging | Public APIs, third-party integrations, CRUD services |
| GraphQL | Prevents over/under-fetching, single endpoint, client-defined schemas | Complex frontend apps, dashboards, mobile backends (BFF) |
| gRPC | HTTP/2 binary serialization (Protobuf), ultra-low latency, bidirectional streaming | Internal microservice-to-microservice communication |
5. API Security: JWT, OAuth2, CORS & Rate Limiting
Authentication & Authorization (JWT vs OAuth2)
OAuth2 handles delegated access authorization. JSON Web Tokens (JWT) act as stateless cryptographically signed bearer tokens carrying user claims.
CORS & Rate Limiting Defenses
Restrict allowed origins via explicit Access-Control-Allow-Origin headers and throttle abusive requests using Token Bucket algorithms in Redis.
Practice REST API & Backend Mock Interviews
Simulate voice-based backend engineering and API design technical interviews with Sophia AI. Instant real-time feedback on architecture, security, and status codes.
6. Frequently Asked REST API Interview Questions
What is the difference between PUT and PATCH?
PUT is used for full resource replacement — you must send all fields of the resource. Any omitted fields may be nullified. PATCH is used for partial modification — you only send the specific fields you wish to update.
How do you implement Rate Limiting for a REST API?
Commonly implemented at the API Gateway or middleware layer using Redis with the Token Bucket or Sliding Window Log algorithm. The server returns headers like X-RateLimit-Limit, X-RateLimit-Remaining, and Retry-After with HTTP 429 when limits are breached.