15 REST API Automation Interview Questions and Answers

REST API automation has become a crucial skill in the software development and testing landscape. As applications increasingly rely on APIs for communication between services, ensuring their reliability and performance through automation is essential. REST APIs, known for their simplicity and scalability, are widely adopted across various industries, making proficiency in their automation a valuable asset.

This article offers a curated selection of interview questions and answers focused on REST API automation. By familiarizing yourself with these questions, you will gain a deeper understanding of key concepts and best practices, enhancing your ability to demonstrate expertise during technical interviews.

REST API Automation Interview Questions and Answers

1. Explain the HTTP methods commonly used in RESTful services.

In RESTful services, HTTP methods perform operations on resources. The most commonly used methods are:

• GET: Retrieves data from a server without modifying resources.
• POST: Creates a new resource on the server by sending data.
• PUT: Updates an existing resource by replacing its current representation.
• DELETE: Removes a resource from the server.
• PATCH: Applies partial modifications to a resource.

2. How would you handle authentication in REST APIs?

Authentication in REST APIs ensures only authorized users access resources. Methods include:

• Basic Authentication: Sends username and password with each request, secure over HTTPS.
• Token-Based Authentication: Uses a server-generated token for subsequent requests.
• OAuth: Allows third-party access without exposing user credentials.
• JWT (JSON Web Tokens): Transmits information securely between parties.

3. Write a Python function to send a GET request to an API endpoint and return the response.

To send a GET request to an API endpoint and return the response, use the requests library in Python:

import requests

def send_get_request(url):
    response = requests.get(url)
    return response.json()

# Example usage
url = 'https://api.example.com/data'
response_data = send_get_request(url)
print(response_data)

4. Write a script to automate the process of sending a POST request with JSON data.

To automate sending a POST request with JSON data, use the requests library in Python:

import requests
import json

url = 'https://example.com/api'
data = {
    'key1': 'value1',
    'key2': 'value2'
}

headers = {
    'Content-Type': 'application/json'
}

response = requests.post(url, data=json.dumps(data), headers=headers)

print(response.status_code)
print(response.json())

5. How would you handle rate limiting in your API automation scripts?

Rate limiting controls the number of requests a client can make in a given time frame. To handle it, check response headers for rate limit information and implement a wait or retry mechanism. Here’s an example using Python:

import time
import requests

def make_request_with_rate_limiting(url, headers):
    response = requests.get(url, headers=headers)
    
    if response.status_code == 429:  # Too Many Requests
        retry_after = int(response.headers.get('Retry-After', 1))
        time.sleep(retry_after)
        return make_request_with_rate_limiting(url, headers)
    
    return response

url = 'https://api.example.com/data'
headers = {'Authorization': 'Bearer YOUR_ACCESS_TOKEN'}

response = make_request_with_rate_limiting(url, headers)
print(response.json())

6. Describe how you would implement error handling in your API automation scripts.

Error handling in API automation scripts involves anticipating issues and implementing mechanisms to manage them. Use try-except blocks to catch exceptions, log errors, and implement retry logic for transient issues.

Example:

import requests
import logging
from requests.exceptions import HTTPError, ConnectionError, Timeout

logging.basicConfig(level=logging.INFO)

def make_api_request(url):
    try:
        response = requests.get(url)
        response.raise_for_status()
    except HTTPError as http_err:
        logging.error(f'HTTP error occurred: {http_err}')
    except ConnectionError as conn_err:
        logging.error(f'Connection error occurred: {conn_err}')
    except Timeout as timeout_err:
        logging.error(f'Timeout error occurred: {timeout_err}')
    except Exception as err:
        logging.error(f'An error occurred: {err}')
    else:
        return response.json()

url = 'https://api.example.com/data'
data = make_api_request(url)
if data:
    print(data)

7. Write a test case to verify the correctness of a REST API endpoint.

To verify the correctness of a REST API endpoint, ensure it returns the expected response for given inputs. This involves making a request, checking the response status code, and validating the response data.

Example using Python’s unittest framework:

import requests
import unittest

class TestAPI(unittest.TestCase):
    def test_get_user(self):
        url = "https://api.example.com/users/1"
        response = requests.get(url)
        
        self.assertEqual(response.status_code, 200)
        
        expected_data = {
            "id": 1,
            "name": "John Doe",
            "email": "[email protected]"
        }
        self.assertEqual(response.json(), expected_data)

if __name__ == "__main__":
    unittest.main()

8. How would you use environment variables in your API automation scripts?

Environment variables store configuration settings and sensitive information, ensuring they are not hardcoded into scripts. Use the os module in Python to access them:

import os
import requests

api_url = os.getenv('API_URL')
api_key = os.getenv('API_KEY')

response = requests.get(f"{api_url}/endpoint", headers={"Authorization": f"Bearer {api_key}"})

print(response.json())

9. Write a script to automate the process of checking the health of multiple API endpoints.

To automate checking the health of multiple API endpoints, use Python with the requests library:

import requests

def check_api_health(endpoints):
    health_status = {}
    for endpoint in endpoints:
        try:
            response = requests.get(endpoint)
            health_status[endpoint] = response.status_code
        except requests.exceptions.RequestException as e:
            health_status[endpoint] = f"Error: {e}"
    return health_status

endpoints = [
    "https://api.example.com/health",
    "https://api.anotherexample.com/status",
    "https://api.yetanotherexample.com/ping"
]

health_status = check_api_health(endpoints)
for endpoint, status in health_status.items():
    print(f"Endpoint: {endpoint}, Status: {status}")

10. How would you handle pagination in API responses in your automation scripts?

To handle pagination in API responses, make multiple requests to retrieve all data. Check for a next page URL or pagination token in the response.

Example:

import requests

def fetch_all_data(base_url):
    data = []
    url = base_url
    while url:
        response = requests.get(url)
        response_data = response.json()
        data.extend(response_data['results'])
        url = response_data.get('next')
    return data

base_url = 'https://api.example.com/data'
all_data = fetch_all_data(base_url)
print(all_data)

11. Write a function to upload a file to an API endpoint using multipart/form-data.

To upload a file to an API endpoint using multipart/form-data in Python, use the requests library:

import requests

def upload_file(url, file_path):
    with open(file_path, 'rb') as file:
        files = {'file': file}
        response = requests.post(url, files=files)
    return response

# Example usage
url = 'https://example.com/upload'
file_path = 'path/to/your/file.txt'
response = upload_file(url, file_path)
print(response.status_code)

12. Write a script to perform a batch operation on multiple API endpoints concurrently.

To perform a batch operation on multiple API endpoints concurrently, use asynchronous programming in Python with asyncio and aiohttp:

import asyncio
import aiohttp

async def fetch(session, url):
    async with session.get(url) as response:
        return await response.text()

async def main(urls):
    async with aiohttp.ClientSession() as session:
        tasks = [fetch(session, url) for url in urls]
        results = await asyncio.gather(*tasks)
        return results

urls = [
    'https://api.example.com/endpoint1',
    'https://api.example.com/endpoint2',
    'https://api.example.com/endpoint3'
]

results = asyncio.run(main(urls))
for result in results:
    print(result)

13. How would you ensure the security of sensitive data in your API automation scripts?

To ensure the security of sensitive data in API automation scripts, follow these practices:

• Encryption: Encrypt data both at rest and in transit. Use HTTPS for secure communication.
• Environment Variables: Store sensitive data like API keys in environment variables.
• Secure Storage Solutions: Use services like AWS Secrets Manager for managing sensitive data.
• Access Controls: Implement role-based access control to limit data access.
• Regular Audits: Conduct security audits and code reviews to identify vulnerabilities.
• Token Management: Use short-lived tokens and implement expiration and revocation mechanisms.

14. What are the common status codes returned by REST APIs and what do they signify?

Common status codes returned by REST APIs include:

• 200 OK: The request has succeeded.
• 201 Created: A new resource has been created.
• 204 No Content: The request was successful, but no content is returned.
• 400 Bad Request: The server could not understand the request due to invalid syntax.
• 401 Unauthorized: Authentication is required to access the resource.
• 403 Forbidden: The client does not have access rights to the content.
• 404 Not Found: The server cannot find the requested resource.
• 500 Internal Server Error: The server encountered an unexpected condition.
• 503 Service Unavailable: The server is not ready to handle the request.

15. What are some common security vulnerabilities in REST APIs and how do you mitigate them?

Common security vulnerabilities in REST APIs include:

• Injection Attacks: Occur when untrusted data is sent to an interpreter. Mitigate by validating and sanitizing input data.
• Broken Authentication: Happens when authentication mechanisms are implemented incorrectly. Use strong authentication and manage session tokens securely.
• Sensitive Data Exposure: Occurs when APIs expose sensitive data. Use HTTPS and encrypt data at rest.
• Broken Access Control: Happens when restrictions on user actions are not enforced. Implement role-based access control.
• Security Misconfiguration: Occurs when security settings are not properly maintained. Regularly update and patch systems.
• Rate Limiting: Prevents abuse by limiting requests. Implement rate limiting and throttling.