REST Interview Questions 2026

Explain common HTTP status codes returned by APIs (2xx, 3xx, 4xx, 5xx). Differentiate between 401 vs 403, 404 vs 400, and 502 vs 503. How do you validate these in automated API tests?

Describe JSON Schema Validation and its importance in API testing. What is a JSON schema? How do you validate that an API response conforms to the expected schema using Rest Assured or Postman? Give an example schema for a user object with required fields and type constraints.

Differentiate between Path Parameters and Query Parameters in REST APIs. Give examples: /users/{id} vs /users?role=admin. When should each be used? How do you pass and validate them in automated API tests using Rest Assured or Postman?

How can nested JSON responses be handled in API testing? Show how to extract a deeply nested value (e.g., response.data.user.address.city) using Rest Assured's JsonPath, and how to validate arrays of objects within the response.

What's the difference between testing a REST API's status code and testing its response schema? Why do you need both?

Design a REST API for an e-commerce cart system. Define the endpoints (add item, remove item, get cart, checkout), explain authentication with JWT, handle race conditions on inventory, and discuss idempotency for the checkout endpoint.

Explain the difference between PUT and PATCH in REST APIs. When is each appropriate? Show how you would test both verbs using Playwright's APIRequestContext, and explain how to validate partial vs full resource updates.

How do you test a REST API that requires OAuth 2.0 authentication? Walk through obtaining a token (client credentials flow), storing it, using it in subsequent requests, and handling token expiry in your automation framework.

Explain the difference between a payment gateway, payment processor, and acquiring bank. How does money actually move when a customer pays with a credit card on a Razorpay-powered checkout? Walk through each hop end to end.

Explain the UPI payment flow end-to-end: from user entering a VPA to money credited. What is NPCI's role? What happens when the beneficiary bank is down? How does Razorpay handle UPI collect vs UPI intent flows?

Explain how Stripe handles exactly-once payment processing. A customer clicks "Pay" twice in quick succession. How does Stripe prevent double-charging? Walk through idempotency keys in the API, database-level constraints, and how the client should handle the case where the first request times out.

Explain PCI-DSS compliance requirements for handling card data. What is tokenisation? How does Stripe use it to ensure raw card numbers never touch customer servers? What are the implications for your API design?

Explain the difference between synchronous and asynchronous API design using Stripe as an example. When does a charge complete immediately vs require a webhook? How do you handle the intermediate "pending" state in your database?

How does Paytm's QR code payment work technically? Explain the difference between static QR (merchant VPA encoded) and dynamic QR (amount pre-filled). What are the security implications of each?

Explain Paytm's mini-app platform architecture. Third-party developers build apps that run inside the Paytm super-app. How do you sandbox them (security), manage their lifecycle, share user identity safely (OAuth), and handle payments on their behalf?

Explain REST API best practices. What makes an API RESTful? Cover: proper use of HTTP verbs, status codes, versioning strategies (/v1/users vs Accept header), pagination (cursor vs offset), and HATEOAS.

Design a REST controller in Spring Boot for a "create order" endpoint. What annotations and validation would you use to ensure a malformed request returns 400 instead of crashing?