REST API Interview Notes (Expanded)
1. Introduction to REST
REST (Representational State Transfer) is an architectural style for designing web APIs. It revolves
around resources, HTTP methods, stateless communication, and standard interfaces. REST APIs
are widely used because they are simple, scalable, cache-friendly, and language-independent.
REST (Representational State Transfer) is an architectural style for designing web APIs. It revolves
around resources, HTTP methods, stateless communication, and standard interfaces. REST APIs
are widely used because they are simple, scalable, cache-friendly, and language-independent.
REST (Representational State Transfer) is an architectural style for designing web APIs. It revolves
around resources, HTTP methods, stateless communication, and standard interfaces. REST APIs
are widely used because they are simple, scalable, cache-friendly, and language-independent.
REST (Representational State Transfer) is an architectural style for designing web APIs. It revolves
around resources, HTTP methods, stateless communication, and standard interfaces. REST APIs
are widely used because they are simple, scalable, cache-friendly, and language-independent.
REST (Representational State Transfer) is an architectural style for designing web APIs. It revolves
around resources, HTTP methods, stateless communication, and standard interfaces. REST APIs
are widely used because they are simple, scalable, cache-friendly, and language-independent.
REST (Representational State Transfer) is an architectural style for designing web APIs. It revolves
around resources, HTTP methods, stateless communication, and standard interfaces. REST APIs
are widely used because they are simple, scalable, cache-friendly, and language-independent.
REST (Representational State Transfer) is an architectural style for designing web APIs. It revolves
around resources, HTTP methods, stateless communication, and standard interfaces. REST APIs
are widely used because they are simple, scalable, cache-friendly, and language-independent.
REST (Representational State Transfer) is an architectural style for designing web APIs. It revolves
around resources, HTTP methods, stateless communication, and standard interfaces. REST APIs
are widely used because they are simple, scalable, cache-friendly, and language-independent.
2. REST Principles
Client-Server separation, Stateless requests, Cacheable responses, Uniform Interface, Layered
architecture, and optional Code-on-Demand. Statelessness enables horizontal scaling.
Client-Server separation, Stateless requests, Cacheable responses, Uniform Interface, Layered
architecture, and optional Code-on-Demand. Statelessness enables horizontal scaling.
Client-Server separation, Stateless requests, Cacheable responses, Uniform Interface, Layered
architecture, and optional Code-on-Demand. Statelessness enables horizontal scaling.
Client-Server separation, Stateless requests, Cacheable responses, Uniform Interface, Layered
architecture, and optional Code-on-Demand. Statelessness enables horizontal scaling.
Client-Server separation, Stateless requests, Cacheable responses, Uniform Interface, Layered
architecture, and optional Code-on-Demand. Statelessness enables horizontal scaling.
Client-Server separation, Stateless requests, Cacheable responses, Uniform Interface, Layered
architecture, and optional Code-on-Demand. Statelessness enables horizontal scaling.
Client-Server separation, Stateless requests, Cacheable responses, Uniform Interface, Layered
architecture, and optional Code-on-Demand. Statelessness enables horizontal scaling.
Client-Server separation, Stateless requests, Cacheable responses, Uniform Interface, Layered
architecture, and optional Code-on-Demand. Statelessness enables horizontal scaling.
3. HTTP Methods
GET retrieves resources, POST creates resources, PUT replaces an entire resource, PATCH
partially updates a resource, DELETE removes a resource, HEAD retrieves headers, OPTIONS
lists supported methods.
GET retrieves resources, POST creates resources, PUT replaces an entire resource, PATCH
partially updates a resource, DELETE removes a resource, HEAD retrieves headers, OPTIONS
lists supported methods.
GET retrieves resources, POST creates resources, PUT replaces an entire resource, PATCH
partially updates a resource, DELETE removes a resource, HEAD retrieves headers, OPTIONS
lists supported methods.
GET retrieves resources, POST creates resources, PUT replaces an entire resource, PATCH
partially updates a resource, DELETE removes a resource, HEAD retrieves headers, OPTIONS
lists supported methods.
GET retrieves resources, POST creates resources, PUT replaces an entire resource, PATCH
partially updates a resource, DELETE removes a resource, HEAD retrieves headers, OPTIONS
lists supported methods.
GET retrieves resources, POST creates resources, PUT replaces an entire resource, PATCH
partially updates a resource, DELETE removes a resource, HEAD retrieves headers, OPTIONS
lists supported methods.
GET retrieves resources, POST creates resources, PUT replaces an entire resource, PATCH
partially updates a resource, DELETE removes a resource, HEAD retrieves headers, OPTIONS
lists supported methods.
GET retrieves resources, POST creates resources, PUT replaces an entire resource, PATCH
partially updates a resource, DELETE removes a resource, HEAD retrieves headers, OPTIONS
lists supported methods.
4. HTTP Status Codes
2xx: Success (200,201,202,204) 3xx: Redirection (301,302,304) 4xx: Client Errors
(400,401,403,404,409,422,429) 5xx: Server Errors (500,502,503,504).
2xx: Success (200,201,202,204) 3xx: Redirection (301,302,304) 4xx: Client Errors
(400,401,403,404,409,422,429) 5xx: Server Errors (500,502,503,504).
2xx: Success (200,201,202,204) 3xx: Redirection (301,302,304) 4xx: Client Errors
(400,401,403,404,409,422,429) 5xx: Server Errors (500,502,503,504).
2xx: Success (200,201,202,204) 3xx: Redirection (301,302,304) 4xx: Client Errors
(400,401,403,404,409,422,429) 5xx: Server Errors (500,502,503,504).
2xx: Success (200,201,202,204) 3xx: Redirection (301,302,304) 4xx: Client Errors
(400,401,403,404,409,422,429) 5xx: Server Errors (500,502,503,504).
2xx: Success (200,201,202,204) 3xx: Redirection (301,302,304) 4xx: Client Errors
(400,401,403,404,409,422,429) 5xx: Server Errors (500,502,503,504).
2xx: Success (200,201,202,204) 3xx: Redirection (301,302,304) 4xx: Client Errors
(400,401,403,404,409,422,429) 5xx: Server Errors (500,502,503,504).
2xx: Success (200,201,202,204) 3xx: Redirection (301,302,304) 4xx: Client Errors
(400,401,403,404,409,422,429) 5xx: Server Errors (500,502,503,504).
5. URI Design
Use nouns instead of verbs. Examples: GET /users GET /users/10 POST /orders GET
/products?category=laptop&page;=2&limit;=20
Use nouns instead of verbs. Examples: GET /users GET /users/10 POST /orders GET
/products?category=laptop&page;=2&limit;=20
Use nouns instead of verbs. Examples: GET /users GET /users/10 POST /orders GET
/products?category=laptop&page;=2&limit;=20
Use nouns instead of verbs. Examples: GET /users GET /users/10 POST /orders GET
/products?category=laptop&page;=2&limit;=20
Use nouns instead of verbs. Examples: GET /users GET /users/10 POST /orders GET
/products?category=laptop&page;=2&limit;=20
Use nouns instead of verbs. Examples: GET /users GET /users/10 POST /orders GET
/products?category=laptop&page;=2&limit;=20
Use nouns instead of verbs. Examples: GET /users GET /users/10 POST /orders GET
/products?category=laptop&page;=2&limit;=20
Use nouns instead of verbs. Examples: GET /users GET /users/10 POST /orders GET
/products?category=laptop&page;=2&limit;=20
6. Authentication
Session-based authentication stores session state on the server. JWT authentication is stateless
and sends the token in every request. OAuth enables third-party authorization.
Session-based authentication stores session state on the server. JWT authentication is stateless
and sends the token in every request. OAuth enables third-party authorization.
Session-based authentication stores session state on the server. JWT authentication is stateless
and sends the token in every request. OAuth enables third-party authorization.
Session-based authentication stores session state on the server. JWT authentication is stateless
and sends the token in every request. OAuth enables third-party authorization.
Session-based authentication stores session state on the server. JWT authentication is stateless
and sends the token in every request. OAuth enables third-party authorization.
Session-based authentication stores session state on the server. JWT authentication is stateless
and sends the token in every request. OAuth enables third-party authorization.
Session-based authentication stores session state on the server. JWT authentication is stateless
and sends the token in every request. OAuth enables third-party authorization.
Session-based authentication stores session state on the server. JWT authentication is stateless
and sends the token in every request. OAuth enables third-party authorization.
7. Pagination
Offset pagination is easy but slows on large datasets. Cursor pagination scales better and avoids
duplicates when data changes.
Offset pagination is easy but slows on large datasets. Cursor pagination scales better and avoids
duplicates when data changes.
Offset pagination is easy but slows on large datasets. Cursor pagination scales better and avoids
duplicates when data changes.
Offset pagination is easy but slows on large datasets. Cursor pagination scales better and avoids
duplicates when data changes.
Offset pagination is easy but slows on large datasets. Cursor pagination scales better and avoids
duplicates when data changes.
Offset pagination is easy but slows on large datasets. Cursor pagination scales better and avoids
duplicates when data changes.
Offset pagination is easy but slows on large datasets. Cursor pagination scales better and avoids
duplicates when data changes.
Offset pagination is easy but slows on large datasets. Cursor pagination scales better and avoids
duplicates when data changes.
8. Caching
Use Cache-Control, ETag, Last-Modified, browser cache, CDN cache, reverse proxy cache, and
Redis to reduce latency and database load.
Use Cache-Control, ETag, Last-Modified, browser cache, CDN cache, reverse proxy cache, and
Redis to reduce latency and database load.
Use Cache-Control, ETag, Last-Modified, browser cache, CDN cache, reverse proxy cache, and
Redis to reduce latency and database load.
Use Cache-Control, ETag, Last-Modified, browser cache, CDN cache, reverse proxy cache, and
Redis to reduce latency and database load.
Use Cache-Control, ETag, Last-Modified, browser cache, CDN cache, reverse proxy cache, and
Redis to reduce latency and database load.
Use Cache-Control, ETag, Last-Modified, browser cache, CDN cache, reverse proxy cache, and
Redis to reduce latency and database load.
Use Cache-Control, ETag, Last-Modified, browser cache, CDN cache, reverse proxy cache, and
Redis to reduce latency and database load.
Use Cache-Control, ETag, Last-Modified, browser cache, CDN cache, reverse proxy cache, and
Redis to reduce latency and database load.
9. Rate Limiting
Algorithms include Fixed Window, Sliding Window, Token Bucket, and Leaky Bucket. Return HTTP
429 when limits are exceeded.
Algorithms include Fixed Window, Sliding Window, Token Bucket, and Leaky Bucket. Return HTTP
429 when limits are exceeded.
Algorithms include Fixed Window, Sliding Window, Token Bucket, and Leaky Bucket. Return HTTP
429 when limits are exceeded.
Algorithms include Fixed Window, Sliding Window, Token Bucket, and Leaky Bucket. Return HTTP
429 when limits are exceeded.
Algorithms include Fixed Window, Sliding Window, Token Bucket, and Leaky Bucket. Return HTTP
429 when limits are exceeded.
Algorithms include Fixed Window, Sliding Window, Token Bucket, and Leaky Bucket. Return HTTP
429 when limits are exceeded.
Algorithms include Fixed Window, Sliding Window, Token Bucket, and Leaky Bucket. Return HTTP
429 when limits are exceeded.
Algorithms include Fixed Window, Sliding Window, Token Bucket, and Leaky Bucket. Return HTTP
429 when limits are exceeded.
10. Idempotency
GET, PUT, and DELETE are idempotent. POST is not idempotent unless an Idempotency-Key is
implemented. Payment systems commonly rely on Idempotency-Key headers.
GET, PUT, and DELETE are idempotent. POST is not idempotent unless an Idempotency-Key is
implemented. Payment systems commonly rely on Idempotency-Key headers.
GET, PUT, and DELETE are idempotent. POST is not idempotent unless an Idempotency-Key is
implemented. Payment systems commonly rely on Idempotency-Key headers.
GET, PUT, and DELETE are idempotent. POST is not idempotent unless an Idempotency-Key is
implemented. Payment systems commonly rely on Idempotency-Key headers.
GET, PUT, and DELETE are idempotent. POST is not idempotent unless an Idempotency-Key is
implemented. Payment systems commonly rely on Idempotency-Key headers.
GET, PUT, and DELETE are idempotent. POST is not idempotent unless an Idempotency-Key is
implemented. Payment systems commonly rely on Idempotency-Key headers.
GET, PUT, and DELETE are idempotent. POST is not idempotent unless an Idempotency-Key is
implemented. Payment systems commonly rely on Idempotency-Key headers.
GET, PUT, and DELETE are idempotent. POST is not idempotent unless an Idempotency-Key is
implemented. Payment systems commonly rely on Idempotency-Key headers.
11. API Versioning
Common strategies include URL versioning (/v1/users), header versioning, and query parameter
versioning. URL versioning is the easiest to understand.
Common strategies include URL versioning (/v1/users), header versioning, and query parameter
versioning. URL versioning is the easiest to understand.
Common strategies include URL versioning (/v1/users), header versioning, and query parameter
versioning. URL versioning is the easiest to understand.
Common strategies include URL versioning (/v1/users), header versioning, and query parameter
versioning. URL versioning is the easiest to understand.
Common strategies include URL versioning (/v1/users), header versioning, and query parameter
versioning. URL versioning is the easiest to understand.
Common strategies include URL versioning (/v1/users), header versioning, and query parameter
versioning. URL versioning is the easiest to understand.
Common strategies include URL versioning (/v1/users), header versioning, and query parameter
versioning. URL versioning is the easiest to understand.
Common strategies include URL versioning (/v1/users), header versioning, and query parameter
versioning. URL versioning is the easiest to understand.
12. Best Practices
Use HTTPS, meaningful status codes, consistent JSON, validation, request IDs, structured logging,
monitoring, pagination, filtering, sorting, compression (gzip/Brotli), API documentation, and
backward compatibility.
Use HTTPS, meaningful status codes, consistent JSON, validation, request IDs, structured logging,
monitoring, pagination, filtering, sorting, compression (gzip/Brotli), API documentation, and
backward compatibility.
Use HTTPS, meaningful status codes, consistent JSON, validation, request IDs, structured logging,
monitoring, pagination, filtering, sorting, compression (gzip/Brotli), API documentation, and
backward compatibility.
Use HTTPS, meaningful status codes, consistent JSON, validation, request IDs, structured logging,
monitoring, pagination, filtering, sorting, compression (gzip/Brotli), API documentation, and
backward compatibility.
Use HTTPS, meaningful status codes, consistent JSON, validation, request IDs, structured logging,
monitoring, pagination, filtering, sorting, compression (gzip/Brotli), API documentation, and
backward compatibility.
Use HTTPS, meaningful status codes, consistent JSON, validation, request IDs, structured logging,
monitoring, pagination, filtering, sorting, compression (gzip/Brotli), API documentation, and
backward compatibility.
Use HTTPS, meaningful status codes, consistent JSON, validation, request IDs, structured logging,
monitoring, pagination, filtering, sorting, compression (gzip/Brotli), API documentation, and
backward compatibility.
Use HTTPS, meaningful status codes, consistent JSON, validation, request IDs, structured logging,
monitoring, pagination, filtering, sorting, compression (gzip/Brotli), API documentation, and
backward compatibility.