Interview Q&A

Short answer: It indicates the request was successful, and the server is returning the expected response body (e.g., GET request returning data).

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: 404 Not Found → The resource does not exist (or the client requested the wrong endpoint). 410 Gone → The resource used to exist but has been permanently removed.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: It indicates the request was well-formed (valid syntax) but could not be processed due to semantic errors. 👉 Example: Submitting a form where email is valid format but already exists.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: It indicates the server timed out waiting for the client’s request. 👉 Example: Client took too long to send data in a POST request.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: 401 Unauthorized → Authentication required (client not logged in / invalid token). 403 Forbidden → Authentication is valid, but the user lacks permissions.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Statelessness means each client request to the server must contain all the necessary information to process it (like authentication token, parameters, body).

Explain a bit more

The server does not store client session state. 👉 Example in ASP.NET Core Web API: [HttpGet("profile")] public IActionResult GetProfile([FromHeader] string token) if (string.IsNullOrEmpty(token)) return Unauthorized(); // Token is validated each time (stateless, no session memory) return Ok(new { Name = "John Doe", Email = "john@example.com" }); }

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Responses from the server should indicate whether they are cacheable or not, to improve performance and scalability. Clients and intermediaries can reuse cached responses. 👉 Example in ASP.NET Core: [HttpGet("products")] [ResponseCache(Duration = 60)] // Cache for 60 seconds public IActionResult GetProducts()

Example code

{
return Ok(new[] { "Laptop", "Mouse", "Keyboard" });
}

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: The uniform interface ensures that REST APIs follow consistent conventions for communication, making them predictable and easy to use. Key aspects: Use of standard HTTP methods (GET, POST, PUT, DELETE). Resource identification via URIs. Resource representations (JSON, XML). Self-descriptive messages.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Each request and response should have enough metadata (headers, content type, status codes) to describe how to process it, without external context. 👉 Example in ASP.NET Core: return Ok(new { Id = 1, Name = "John", Links = new[] { new { Rel = "self", Href = "/users/1" } } }); Here, the response describes itself (content type = JSON, includes resource links).

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: How would you version a REST API? Versioning ensures backward compatibility when APIs change. Common approaches: URI versioning → /api/v1/users Header-based versioning → Accept: application/vnd.myapi.v1+json Query parameter → /users?version=1

Real-world example (ShopNest)

ShopNest mobile app sends a JWT Bearer token. The API validates it and uses the user id from claims to load that user’s cart only.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Versioning ensures backward compatibility when APIs change. Common approaches: URI versioning → /api/v1/users Header-based versioning → Accept: application/vnd.myapi.v1+json Query parameter → /users?version=1

Real-world example (ShopNest)

ShopNest mobile app sends a JWT Bearer token. The API validates it and uses the user id from claims to load that user’s cart only.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Lightweight and easy to parse. Language independent. Human-readable. Supported natively by JavaScript and most frameworks.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use throttling to limit requests per minute/hour per client. Return 429 Too Many Requests. Provide Retry-After header. Tools: API Gateway, NGINX, Middleware.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: An API key is a unique token used to authenticate requests. 👉

Example code

GET /users?apikey=12345 Best practice: Send in headers → Authorization: ApiKey 12345.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Synchronous → Client waits until the server responds (blocking). Asynchronous → Server processes request in background and may send response later (via polling, callbacks, or webhooks).

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Used for CORS preflight requests. Tells the client which HTTP methods and headers are allowed. 👉 Example Response: Allow: GET, POST, PUT, DELETE Access-Control-Allow-Origin: *

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Provides clear usage guidelines for developers. Reduces onboarding time for new teams. Ensures consistency across different services. Helps with discoverability of endpoints, parameters, request/response formats. 👉 Tools: Swagger (OpenAPI), Postman, Redoc.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: rchitecture? API Gateway is a single entry point for APIs in a microservices architecture. Handles routing, load balancing, authentication, rate limiting, logging, monitoring. Examples: Kong, NGINX, AWS API Gateway, Azure API Management. Use when: You have multiple microservices. Need centralized authentication/security. Need rate limiting or… monitoring.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Rate limiting restricts the number of API requests per user/IP in a given time. Prevents abuse (DDoS, brute force). Ensures fair usage and protects backend systems. Return 429 Too Many Requests with Retry-After header. 👉 Example: 100 requests/minute per API key.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Ensures correctness, reliability, performance, and security of APIs. Postman → Manual and automated API testing, environment variables, collections. Swagger (OpenAPI) → Live documentation, mock servers, auto-generated client SDKs. Automates QA process and reduces bugs in production.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Caching is storing frequently used data temporarily to reduce server load and improve response time. Implementation methods: HTTP caching headers (Cache-Control, ETag, Expires). Reverse proxies (Varnish, NGINX). In-memory stores (Redis, Memcached). Client-side caching using 304 Not Modified.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Content negotiation allows clients to specify desired response format. Uses HTTP headers: Accept: application/json → Request JSON. Accept: application/xml → Request XML. The server returns response in requested format (if supported). 👉 Example in ASP.NET Core: Add XML formatter with services.AddControllers() .AddXmlSerializerFormatters();

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: PI performance? A CDN caches and delivers static or semi-static content from edge servers close to users. Reduces latency and improves response times. Helps with traffic offloading, reducing load on origin servers. Supports DDoS protection and scaling under heavy loads. 👉 Cloudflare, Akamai, AWS CloudFront. Real-world example… (ShopNest) ShopNest… exposes REST APIs for cart and checkout. Controllers stay thin;…

Explain a bit more

business rules live in application services. PI performance? A CDN caches and delivers static or semi-static content from edge servers close to users. Reduces latency and improves response times. Helps with traffic offloading, reducing load on origin servers. Supports DDoS protection and scaling under heavy loads. 👉

Example code

Cloudflare, Akamai, AWS CloudFront. Real-world example… (ShopNest) ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: A CDN caches and delivers static or semi-static content from edge servers close to users. Reduces latency and improves response times. Helps with traffic offloading, reducing load on origin servers. Supports DDoS protection and scaling under heavy loads. 👉 Example: Cloudflare, Akamai, AWS CloudFront.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Swagger/OpenAPI is a specification for defining REST APIs. Provides machine-readable and human-readable documentation. Enables automatic client SDK generation, testing, and validation. Improves team collaboration and consistency in API design.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.