REST, SOAP, Authentication, JWT, OAuth & Advanced Concepts)

Modern software applications are heavily dependent on APIs. Whether it is a web application, mobile application, microservices architecture, or cloud-based platform, APIs act as the communication layer between different systems. This article covers frequently asked API Testing Interview Questions and Answers with practical examples.

1. What is API Testing?

API Testing is a type of software testing where we validate the functionality, reliability, performance, and security of Application Programming Interfaces.

Unlike UI testing, API testing validates the backend layer directly by sending requests and verifying responses.

API testing mainly focuses on:

• Request validation
• Response validation
• Data accuracy
• Status codes
• Headers
• Authentication
• Authorization
• Error handling
• Performance
• Security

Example:

A user registration API:

POST /api/users

Request:

{
  "name": "John",
  "email": "john@test.com"
}

Response:

{
  "id": 101,
  "name": "John",
  "status": "created"
}

An API test validates:

• HTTP status code
• Response body
• Response headers
• Response schema
• Response time

2. Why is API Testing Important for Automation Engineers?

Modern applications use distributed architectures where multiple services communicate through APIs.

API testing helps:

• Detect backend issues early
• Reduce dependency on UI availability
• Execute tests faster
• Validate business logic
• Improve test coverage
• Test microservices independently

Example:

Instead of creating a user manually through UI before testing checkout functionality, an automation engineer can call:

POST /users

to create test data instantly.

3. What is REST API?

REST stands for Representational State Transfer.

REST is an architectural style used for designing web services that communicate over HTTP.

REST APIs are:

• Lightweight
• Stateless
• Platform independent
• Easy to consume

Common REST API formats:

• JSON
• XML

Example REST endpoint:

GET https://api.example.com/users/101

Response:

{
 "id":101,
 "name":"John"
}

4. What is SOAP API?

SOAP stands for Simple Object Access Protocol.

SOAP is a protocol used for exchanging structured information between applications.

SOAP APIs:

• Use XML format
• Have strict standards
• Support WS-Security
• Are commonly used in banking and enterprise applications

Example SOAP Request:

<soapenv:Envelope>
 <soapenv:Body>
   <GetCustomer>
     <CustomerId>101</CustomerId>
   </GetCustomer>
 </soapenv:Body>
</soapenv:Envelope>

REST vs SOAP:

5. Explain HTTP Methods in API Testing

HTTP methods define the operation performed on a resource.

GET

Used to retrieve data.

Example:

GET /users/101

Response:

{
"id":101,
"name":"John"
}

POST

Used to create new resources.

Example:

POST /users

Request:

{
"name":"John",
"email":"john@test.com"
}

PUT

Used to completely update an existing resource.

Example:

PUT /users/101

PATCH

Used for partial updates.

Example:

{
"email":"newemail@test.com"
}

DELETE

Used to remove resources.

Example:

DELETE /users/101

6. What are CRUD Operations in API Testing?

CRUD represents the four basic database operations.

Example:

Create User:

POST /users

Read User:

GET /users/101

Update User:

PUT /users/101

Delete User:

DELETE /users/101

7. Explain HTTP Status Codes in API Testing

HTTP status codes indicate the result of an API request.

2xx Success Codes

200 OK

Request successful.

Example:

GET /users

returns user data.

201 Created

Resource successfully created.

Example:

POST /users

204 No Content

Request successful but no response body.

Example:

DELETE /users/101

4xx Client Errors

400 Bad Request

Invalid request data.

Example:

Missing mandatory field.

{
"name":""
}

401 Unauthorized

Authentication failed.

Example:

Invalid token.

403 Forbidden

User authenticated but does not have permission.

404 Not Found

Resource does not exist.

5xx Server Errors

500 Internal Server Error

Unexpected server failure.

8. What are HTTP Headers in API Testing?

Headers provide additional information about requests and responses.

Common request headers:

Content-Type: application/json
Authorization: Bearer token123
Accept: application/json

Common response headers:

Content-Type
Cache-Control
Set-Cookie

Example:

given()
.header("Content-Type","application/json")
.when()
.get("/users");

9. Authentication vs Authorization

Authentication

Authentication verifies who the user is.

Examples:

• Username/password
• API Key
• JWT Token
• OAuth

Question:

“Who are you?”

Authorization

Authorization determines what actions the user can perform.

Question:

“What are you allowed to access?”

Example:

Admin:

POST /users

allowed.

Normal User:

GET /users

only.

10. Explain OAuth Authentication

OAuth (Open Authorization) is a token-based authorization framework.

It allows applications to access resources without sharing passwords.

OAuth flow:

1. User authenticates
2. Authorization server provides token
3. Client uses token for API requests

Example:

Request:

Authorization: Bearer access_token

Common OAuth versions:

• OAuth 2.0
• OpenID Connect

11. What is JWT Authentication?

JWT stands for JSON Web Token.

JWT is a compact token format used for securely transmitting information.

JWT structure:

Header.Payload.Signature

Example:

eyJhbGciOiJIUzI1Ni...

API request:

GET /profile
Authorization: Bearer JWT_TOKEN

JWT contains:

• User information
• Expiration time
• Claims

12. What is a Bearer Token?

Bearer Token is an access token sent in HTTP Authorization header.

Example:

Authorization: Bearer abc123xyz

The server validates the token before processing the request.

13. JSON vs XML in API Testing

JSON

Advantages:

• Lightweight
• Easy to read
• Commonly used in REST APIs

Example:

{
"id":101,
"name":"John"
}

XML

Advantages:

• Supports complex structures
• Used heavily in SOAP APIs

Example:

<Customer>
<Name>John</Name>
</Customer>

14. How do you Validate JSON Response?

Example response:

{
"id":101,
"name":"John"
}

Validation:

• Status code
• JSON fields
• Data types
• Schema

Example using Rest Assured:

given()
.when()
.get("/users/101")
.then()
.statusCode(200)
.body("name", equalTo("John"));

15. What is Schema Validation in API Testing?

Schema validation verifies whether the response structure matches the expected format.

Example schema validation checks:

• Mandatory fields
• Data types
• Field names
• Nested structures

Example:

then()
.body(matchesJsonSchemaInClasspath("user-schema.json"));

16. What is Contract Testing?

Contract testing validates that communication between services follows an agreed contract.

Example:

Consumer expects:

{
"id":101,
"name":"John"
}

If producer changes:

{
"userId":101
}

the contract test fails.

Popular tools:

• Pact
• Spring Cloud Contract

17. Explain Idempotency in API Testing

An API is idempotent if executing the same request multiple times produces the same result.

Idempotent methods:

• GET
• PUT
• DELETE

Example:

First request:

DELETE /users/101

Second request:

DELETE /users/101

Final state remains the same.

POST is generally not idempotent.

Example:

POST /orders

may create multiple orders.

18. What is Pagination Testing?

Pagination is used when APIs return large amounts of data.

Example:

Request:

GET /users?page=2&limit=10

Testing scenarios:

• Verify page size
• Verify next page link
• Verify last page
• Verify duplicate records
• Verify missing records

19. What is Rate Limiting Testing?

Rate limiting controls how many requests a client can send within a specific time.

Example:

API allows:

100 requests/minute

Testing:

Send 101 requests.

Expected:

429 Too Many Requests

Validate:

• Limit headers
• Error message
• Retry behavior

20. Explain Error Handling Testing

API error handling testing validates whether APIs return proper errors.

Example:

Invalid user ID:

Request:

GET /users/999999

Expected:

Status:

404

Response:

{
"message":"User not found"
}

Validate:

• Status code
• Error message
• Error format
• Error codes

21. What is Negative Testing in API Testing?

Negative testing verifies how APIs behave with invalid inputs.

Examples:

Invalid authentication:

Authorization: InvalidToken

Expected:

401 Unauthorized

Missing required field:

{
"email":""
}

Expected:

400 Bad Request

Other scenarios:

• Invalid data types
• SQL injection attempts
• Invalid parameters
• Boundary values

22. Real-Time API Testing Interview Scenario

Scenario:

API returns:

HTTP 200 OK

but response body is empty.

What will you do?

Answer:

A successful status code does not always mean the API is working correctly.

Validate:

• Business expectation
• Response schema
• Mandatory fields
• Database state
• Logs

Example:

Expected:

{
"id":101
}

Actual:

{}

The test should fail because the contract is broken.

23. API Testing Automation Tools

Popular API automation tools:

• Rest Assured (Java)
• Postman
• Newman
• SoapUI
• Karate Framework
• Playwright API Testing
• Python Requests
• Cypress API Testing

Example Rest Assured:

given()
.contentType(ContentType.JSON)
.when()
.get("/users")
.then()
.statusCode(200);

Final Thoughts

API testing is now an essential skill for modern automation engineers. Interviewers expect candidates to understand not only basic REST concepts but also advanced areas like authentication, contract testing, schema validation, idempotency, pagination, rate limiting, and negative testing.

A strong API automation engineer should be comfortable validating APIs independently and integrating API tests into CI/CD pipelines.

Mastering these API Testing Interview Questions and Answers will help QA Automation Engineers confidently handle real-world automation interviews and projects.

Related Links

• What is API Testing
• REST HTTP Methods
• What is REST Assured
• Setup
• First Test
• Request Specification Explained
• E2E API Testing Flow
• Response Validation
• Authentication methods
• API framework design
• CI/CD Integration for REST Assured