🔌 API Tester interview prep

// WHO THIS IS FOR

For engineers interviewing for roles centred on REST and GraphQL API testing, contract and schema validation, and building API automation suites in REST Assured, Karate, or similar frameworks. Covers mid-to-senior scopes where interviewers expect you to go beyond manual Postman exploration to data-driven, code-driven API test design.

// SKILLS INTERVIEWERS EXPECT

Green = most frequently tested

// TYPICAL INTERVIEW ROUNDS

1. 1

   API fundamentals

   30–45 min questions-only round covering HTTP methods and their idempotency rules, status code semantics (2xx, 4xx, 5xx), authentication mechanisms (API keys, Bearer tokens, OAuth 2.0 flows), REST vs SOAP, and JSON vs XML. Interviewers also probe REST constraints (statelessness, uniform interface) and what makes an API testable. Expect follow-ups on how you would test a flawed API design.

2. 2

   Hands-on API testing task

   Given a live API or a Swagger/OpenAPI spec, write test cases covering the happy path, error responses (400, 401, 404, 422), boundary conditions, and chained request flows (create → read → update → delete). You may work in Postman, REST Assured, or Karate depending on the team's stack. Interviewers look for structured assertion coverage, not just status code checks — response body, headers, schema, and timing.

3. 3

   Automation and framework design

   How you structure an API test suite for a microservices backend: layer separation, shared authentication helpers, environment configuration, and data-driven parameterisation. May include a live coding segment adding tests to an existing suite. Senior roles extend to consumer-driven contract testing with Pact and integrating API tests into a CI pipeline with parallel execution.

4. 4

   Behavioural

   Situational questions — an API breaks backward compatibility, a service returns inconsistent status codes, a bug is only reproducible under load. Also covers how you document API defects clearly for backend engineers, how you shift left into API design reviews, and how you decide which API scenarios need automation vs remain as exploratory checks.

// TOPICS TO STUDY

• HTTP methods: GET, POST, PUT, PATCH, DELETE — idempotency and safe vs unsafe
• Status code ranges: 2xx success, 3xx redirect, 4xx client error, 5xx server error — common codes
• Authentication: API keys, Bearer tokens, OAuth 2.0 (client credentials, auth code), session cookies
• JSON schema validation: required fields, type checks, additionalProperties, nested objects
• Request chaining: extracting and passing auth tokens, resource IDs across test steps
• REST Assured: given/when/then DSL, path params, query params, response extraction, JSON path
• Karate DSL: feature file syntax, shared state via call, mocking with karate-netty
• Contract testing: consumer-driven contracts, Pact terminology (consumer, provider, pact file)
• Postman: collections, environments, test scripts with pm.expect, Newman CLI for CI

// READINESS SELF-CHECK