Backend & APIs interview questions
52 Backend & APIs interview questions with answers, from junior to mid level.
Foundations
- What is the backend of a web application?
- What is a server?
- In 'client and server', what is a client?
- What does 'full-stack developer' mean?
- Restaurant analogy: the customer orders from a waiter, who takes the order to the kitchen and brings back the food. Which part is the API?
- What is HTTP?
- In the address
https://api.shop.com/products?id=7, which part is the path? - Which sentence best describes REST?
- What does a backend web framework such as Spring Boot, FastAPI or Django do for you?
- In an HTTP conversation, who sends the first message?
Core
- What is the difference between PUT and PATCH?
- A logged-in user requests another tenant's invoice. Which status code is most appropriate?
- A successful
POST /usersthat creates a user should ideally return… - What is an API?
- Which list contains the main parts of an HTTP request?
- What is the purpose of a GET request?
- What do HTTP status codes starting with 2, 4 and 5 mean?
GET /users/9999and that user does not exist. Correct status code?- Your API returns 500 Internal Server Error. What does that usually indicate?
- What is JSON?
- In
GET /users/42/orders?status=paid&limit=10, which are the path parameter and the query parameters? - Which endpoint follows REST naming conventions?
- What does HTTPS add to HTTP?
- What does the request header
Content-Type: application/jsontell the server? - In FastAPI, what does
@app.get("/items/{item_id}")above a function do?
Intermediate
- Which HTTP method is NOT idempotent by definition?
- FastAPI receives a body that fails Pydantic validation. Default response status?
- A client exceeds the rate limit. Which status and header are standard?
- Which statement about a standard signed JWT (JWS) is true?
- For a browser web app, where is a session/auth token safest from XSS theft?
- What is middleware in a web framework?
- Which statement about CORS is correct?
- Listing 50 orders then accessing
order.customer.namein a loop triggers 51 queries. In Django, the usual fix for this foreign key is… - In SQLAlchemy, what is the
Sessionprimarily? - What does
Depends(get_db)in a FastAPI endpoint signature do? - WSGI vs ASGI: what does ASGI add?
- Which REST constraint means each request carries all information needed to process it?
- An endpoint generates a 2-minute report. Best API design?
- Which API versioning approach is most common and explicit in public REST APIs?
- Design a REST API for a bookings resource (hotel rooms). What endpoints, codes and concerns?
Advanced
- Main drawback of stateless JWT access tokens?
- Which OAuth 2.0 flow is recommended for single-page apps and mobile apps?
- In FastAPI you must call a slow, blocking SDK. Which option avoids blocking the event loop?
- Why is cursor (keyset) pagination preferred over
OFFSETfor large, changing datasets? - A mobile app retries a payment POST after a timeout. How do you prevent a double charge?
- Which rate limiting algorithm naturally allows short bursts while enforcing an average rate?
- What does gRPC typically offer over JSON/REST?
- In GraphQL, resolving
posts { author { name } }naively causes many DB queries. Common fix? - How should your service verify incoming webhooks from a provider?
- A client sends
If-None-Match: "abc123"and the resource is unchanged. Server response? - A common starting point for the number of Gunicorn sync workers is…
- How would you secure a REST API end to end?