Interview Q&A

Short answer: Pros: Secure delegated access. Widely adopted (Google, Facebook, GitHub). Works well for 3rd-party apps. Cons: Complex implementation. Requires token management. Overhead for small/simple APIs.

Real-world example (ShopNest)

ShopNest mobile app sends a JWT Bearer token. The API validates it and uses the user id from claims to load that user’s cart only.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: GET, PUT, DELETE → Ensure repeated requests produce the same result. Avoid side effects on repeated requests. Use unique request IDs for POST (to prevent duplicate creation).

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: SQL Injection Cross-Site Scripting (XSS) Cross-Site Request Forgery (CSRF) Broken Authentication Insecure Direct Object References (IDOR) Unencrypted data transmission

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Always use parameterized queries / ORM (EF Core). Validate and sanitize input. Apply least privilege on DB users. 👉 Example in EF Core: var user = db.Users.FirstOrDefault(u => u.Email == email);

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Malicious sites could misuse APIs if CORS is too permissive. Always restrict origins (Access-Control-Allow-Origin). Avoid * in production. Use tokens for security.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use structured logging (Serilog, NLog). Log important events (auth failures, errors, requests). Implement monitoring tools (Application Insights, ELK Stack). Add correlation IDs for tracing requests.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: URI Versioning → /api/v1/users Header Versioning → Accept: application/vnd.myapi.v2+json Best practice: URI versioning for clarity.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: XML YAML CSV Protocol Buffers (gRPC) Plain text

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Webhooks are server-to-server callbacks triggered by events. 👉 Example: Stripe API calls your endpoint /payment/confirmed when a payment succeeds.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Always return limited results (avoid huge payloads). Provide page and limit parameters → /users?page=2&limit=20. Return metadata → { "page": 2, "totalPages": 10 }. Support cursor-based pagination for large datasets.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use tools like Postman Collections, Newman, RestAssured (Java), Supertest (Node.js), xUnit/NUnit (C#). Integrate tests into CI/CD pipelines (Jenkins, GitHub Actions, Azure DevOps). Automate unit, integration, and load tests. Ensure regression testing after deployments.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Async Processing → Return 202 Accepted with a status URL (/jobs/{id}). Client polls the status endpoint until job is complete. Optionally use Webhooks for notifying clients. 👉 Example: File processing, report generation.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Configure CORS policy on the server. Allow specific origins, headers, and methods. 👉 Example in ASP.NET Core: services.AddCors(options => { options.AddPolicy("MyPolicy", builder => builder.WithOrigins(" .AllowAnyHeader() .AllowAnyMethod()); }); Apply with app.UseCors("MyPolicy");.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Idempotent = multiple identical requests have the same effect as one request. Important for reliability and safe retries. HTTP Methods: GET, PUT, DELETE → Idempotent. POST → Not idempotent (creates new resource each time).

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: 2xx Success → 200 (OK), 201 (Created). 4xx Client Errors → 400 (Bad Request), 401 (Unauthorized), 404 (Not Found). 5xx Server Errors → 500 (Internal Server Error), 503 (Service Unavailable). Error responses should include structured messages: { "status": 400, "error": "Invalid Data", "details": "Email is required" }

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Horizontal scaling → Add more servers/containers. Load balancing across multiple instances. Database optimization (indexes, partitioning, read replicas). Caching at server, client, and CDN levels. Use asynchronous processing for long-running tasks. Apply rate limiting and throttling to prevent abuse. Adopt microservices architecture for modular scaling.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use a load balancer (NGINX, HAProxy, AWS ELB, Azure Front Door). Distribute traffic across multiple instances to avoid bottlenecks. Support round-robin, least connections, or IP hash strategies. Enable health checks to route traffic only to healthy instances. Combine with auto-scaling for dynamic traffic management.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Reduce payload size (use JSON instead of XML, compress responses). Implement pagination for large datasets. Apply caching at multiple levels. Use async I/O (non-blocking calls). Minimize database calls (batch queries, stored procedures). Enable GZIP compression on responses. Profile and monitor using APM tools (New Relic, Application Insights).

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Client-side caching → Reduces server calls, but may serve stale data. Server-side caching → Faster responses, but increases memory usage. Proxy caching/CDN → Global scalability, but harder cache invalidation. Database caching (Redis) → Faster queries, but adds complexity and consistency issues.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: REST API? Add query parameters: Filtering: /products?category=shoes&brand=nike Sorting: /products?sort=price_asc Searching: /products?search=wireless+headphones Use LINQ/SQL queries in backend. Ensure query optimization with indexes. Implement validation to prevent SQL injection.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Add query parameters: Filtering: /products?category=shoes&brand=nike Sorting: /products?sort=price_asc Searching: /products?search=wireless+headphones Use LINQ/SQL queries in backend. Ensure query optimization with indexes. Implement validation to prevent SQL injection.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Deploy servers closer to users (geo-distributed hosting). Use CDNs for static content. Apply connection pooling for databases. Reduce number of API calls (batching, GraphQL alternative). Use HTTP/2 or gRPC for faster communication. Monitor latency with APM tools and optimize bottlenecks.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Swagger/OpenAPI → Standard for REST API design and documentation. Postman → Can generate collections and documentation automatically. Redoc → Static documentation from OpenAPI specs. RAML → RESTful API Modeling Language. Stoplight, Apiary, Docusaurus → Modern documentation and mocking platforms.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: In ASP.NET Core: Use Swashbuckle package to generate Swagger UI from controllers and annotations.

Explain a bit more

services.AddSwaggerGen(c => { c.SwaggerDoc("v1", new OpenApiInfo { Title = "My API", Version = "v1" }); }); app.UseSwagger(); app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "My API v1")); Other frameworks (Node.js: swagger-jsdoc, Spring Boot: springdoc-openapi) also support annotations and automatic documentation.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use try-catch blocks in code to catch exceptions. Implement global exception handling middleware in ASP.NET Core: app.UseExceptionHandler(appError => { appError.Run(async context => {

Example code

context.Response.StatusCode = 500;
context.Response.ContentType = "application/json";
await context.Response.WriteAsync(new { message = "Internal Server Error" }.ToString()); }); }); Log exceptions for debugging and monitoring.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.