Interview Q&A

Short answer: Lightweight and easy to parse. Language independent. Human-readable. Supported natively by JavaScript and most frameworks.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Consistency in naming and responses. Error handling with meaningful messages. Security (HTTPS, JWT, OAuth2). Scalability (statelessness, caching). Performance (pagination, filtering). Documentation (Swagger/OpenAPI).

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Return proper status codes and a structured error object: 👉 Example in ASP.NET Core: { "status": 400, "error": "Invalid Request", "details": "Email field is required" }

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Prevents large payloads. Improves performance and response times. Reduces server and network load. 👉

Example code

GET /users?page=2&limit=20.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use throttling to limit requests per minute/hour per client. Return 429 Too Many Requests. Provide Retry-After header. Tools: API Gateway, NGINX, Middleware.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Authentication → API Keys, JWT, OAuth2. Authorization → Role-based access control. Always use HTTPS. Validate input & sanitize data. Prevent SQL injection, XSS, CSRF.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Provide versioning. Send Deprecation warning headers. Maintain old versions temporarily. Give developers migration guides.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: An API key is a unique token used to authenticate requests. 👉

Example code

GET /users?apikey=12345 Best practice: Send in headers → Authorization: ApiKey 12345.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthentication? Pros: Secure delegated access. Widely adopted (Google, Facebook, GitHub). Works well for 3rd-party apps. Cons: Complex implementation. Requires token management. Overhead for small/simple APIs.

Real-world example (ShopNest)

ShopNest mobile app sends a JWT Bearer token. The API validates it and uses the user id from claims to load that user’s cart only.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Pros: Secure delegated access. Widely adopted (Google, Facebook, GitHub). Works well for 3rd-party apps. Cons: Complex implementation. Requires token management. Overhead for small/simple APIs.

Real-world example (ShopNest)

ShopNest mobile app sends a JWT Bearer token. The API validates it and uses the user id from claims to load that user’s cart only.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: GET, PUT, DELETE → Ensure repeated requests produce the same result. Avoid side effects on repeated requests. Use unique request IDs for POST (to prevent duplicate creation).

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: SQL Injection Cross-Site Scripting (XSS) Cross-Site Request Forgery (CSRF) Broken Authentication Insecure Direct Object References (IDOR) Unencrypted data transmission

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Always use parameterized queries / ORM (EF Core). Validate and sanitize input. Apply least privilege on DB users. 👉 Example in EF Core: var user = db.Users.FirstOrDefault(u => u.Email == email);

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Malicious sites could misuse APIs if CORS is too permissive. Always restrict origins (Access-Control-Allow-Origin). Avoid * in production. Use tokens for security.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use structured logging (Serilog, NLog). Log important events (auth failures, errors, requests). Implement monitoring tools (Application Insights, ELK Stack). Add correlation IDs for tracing requests.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: URI Versioning → /api/v1/users Header Versioning → Accept: application/vnd.myapi.v2+json Best practice: URI versioning for clarity.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: XML YAML CSV Protocol Buffers (gRPC) Plain text

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Synchronous → Client waits until the server responds (blocking). Asynchronous → Server processes request in background and may send response later (via polling, callbacks, or webhooks).

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Webhooks are server-to-server callbacks triggered by events. 👉 Example: Stripe API calls your endpoint /payment/confirmed when a payment succeeds.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Used for CORS preflight requests. Tells the client which HTTP methods and headers are allowed. 👉 Example Response: Allow: GET, POST, PUT, DELETE Access-Control-Allow-Origin: *

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Always return limited results (avoid huge payloads). Provide page and limit parameters → /users?page=2&limit=20. Return metadata → { "page": 2, "totalPages": 10 }. Support cursor-based pagination for large datasets.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Provides clear usage guidelines for developers. Reduces onboarding time for new teams. Ensures consistency across different services. Helps with discoverability of endpoints, parameters, request/response formats. 👉 Tools: Swagger (OpenAPI), Postman, Redoc.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use tools like Postman Collections, Newman, RestAssured (Java), Supertest (Node.js), xUnit/NUnit (C#). Integrate tests into CI/CD pipelines (Jenkins, GitHub Actions, Azure DevOps). Automate unit, integration, and load tests. Ensure regression testing after deployments.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Async Processing → Return 202 Accepted with a status URL (/jobs/{id}). Client polls the status endpoint until job is complete. Optionally use Webhooks for notifying clients. 👉 Example: File processing, report generation.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: rchitecture? API Gateway is a single entry point for APIs in a microservices architecture. Handles routing, load balancing, authentication, rate limiting, logging, monitoring. Examples: Kong, NGINX, AWS API Gateway, Azure API Management. Use when: You have multiple microservices. Need centralized authentication/security. Need rate limiting or… monitoring.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.