API Testing Questions
Part of the QA Testing Roadmap
In short
'How would you test this endpoint?' is really asking: do you think about auth, bad input, error codes and data, or do you stop at '200 OK'? Here's how to show the full picture.
'How would you test this API endpoint?' — testing Phase 8's API test design skills against a concrete scenario, including authentication and error handling.
Think of it like this
The restaurant waiter
A waiter takes your order to the kitchen and brings back food. A good test of the waiter checks the right dish arrives, what happens if you order something not on the menu, and that he won't serve another table's order to you.
Watch it happen
Testing GET /users/{id} from every angle
GET /users/7 + token
1/6Happy path with a valid token for user 7.
The big ideas
What you need to know
Status codes
Know the common ones cold: 200, 201, 204, 400, 401, 403, 404, 409, 500. And when each should appear.
Body, not just status
Validate fields, data types and values. Mention schema validation as a way to check structure automatically.
Auth cases
Missing, invalid, expired and wrong-user tokens. These show security awareness interviewers love.
Methods matter
PUT, PATCH and DELETE each need tests. Ask: is calling DELETE twice safe? What should the second call return?
See it in code
Walk through the code
1# Happy path2curl -i https://api.example.test/users/7 -H "Authorization: Bearer $TOKEN"3 4# No token: expect 4015curl -i https://api.example.test/users/76 7# Bad body: expect 400 with a clear error message8curl -i -X POST https://api.example.test/users \9 -H "Content-Type: application/json" -d '{"email": "not-an-email"}'1/3A normal authenticated request.
curl -i shows status and headers too. Being comfortable with curl or Postman is often checked in interviews.
Save yourself the pain
Common mistakes
Oops
Answering 'I'd check it returns 200'.
Do this instead
Cover positive, negative, auth, boundaries, error format and performance, then prioritise.
Oops
Mixing up 401 and 403.
Do this instead
401 means 'who are you?', no valid login. 403 means 'I know you, but you're not allowed'.
Your mission
Test a public API
Quick check
A logged-in user requests another user's private profile. What should the API return?
Go deeper
- 1Practice designing API test cases live for a hypothetical endpoint.
- 2Prepare to discuss status codes and what each range signals.
- 3Practice explaining how you'd test both successful and failed authentication scenarios.
More automation & technical at this stop
Selenium/Playwright Coding Questions
SQL Questions for QA
Stuck on this topic? Ask an Insider
Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.
