How to create REST APIs in ASP.NET Core?

Short answer: Creating REST APIs in ASP.NET Core is straightforward using controllers or minimal PIs.

Explain a bit more

Example: Traditional Controller-Based API dotnet new webapi -n MyApi Program.cs: var builder = WebApplication.CreateBuilder(args); builder.Services.AddControllers(); var app = builder.Build(); pp.MapControllers(); pp.Run(); Controller: [ApiController] [Route("api/[controller]")] public class ProductsController : ControllerBase { [HttpGet] public IActionResult GetAll() => Ok(new[] { "Laptop", "Phone" }); } ✅ You get RESTful endpoints automatically (GET /api/products). {

Example code

if (!ModelState.IsValid)
return BadRequest(ModelState);
return CreatedAtAction(nameof(CreateOrder), new { id = 1 }, order); }
} 📦 3. How does content negotiation work? Content negotiation allows clients to request responses in a specific format (JSON, XML, etc.) using the Accept header. SP.NET Core automatically picks the best formatter: GET /api/products ccept: application/json Response → JSON GET /api/products ccept: application/xml Response → XML (if XML formatter is added) Enable XML Support: builder.Services.AddControllers() .AddXmlSerializerFormatters(); 🧭 4. How to handle versioning in APIs? You can version APIs to maintain backward compatibility using the Microsoft.AspNetCore.Mvc.Versioning package. Install: dotnet add package Microsoft.AspNetCore.Mvc.Versioning Configure: builder.Services.AddApiVersioning(options => {
options.DefaultApiVersion = new ApiVersion(1, 0);
options.AssumeDefaultVersionWhenUnspecified = true;
{ [HttpGet] public IActionResult Get() => Ok("Version 1");
} ⚠ 5. What is ProblemDetails? ProblemDetails is a standardized JSON structure for API error responses (RFC 7807). Example Output: { "type": " "title": "Resource not found", "status": 404, "detail": "Product with ID 5 was not found" } Usage: return NotFound(new ProblemDetails
{ Title = "Product not found", Status = StatusCodes.Status404NotFound, Detail = "The product ID 5 does not exist." }); 🚦 6. How to return custom HTTP status codes? You can use built-in helpers from ControllerBase: Method Status Code Ok() 200 Created() / CreatedAtAction() 201 NoContent() 204 BadRequest() 400 Unauthorized() 401 NotFound() 404 StatusCode(500) Custom Example: return StatusCode(503, "Service temporarily unavailable"); 📄 7. How to implement pagination in APIs? Pagination helps manage large datasets efficiently. Example: [HttpGet] public IActionResult GetProducts([FromQuery] int page = 1, [FromQuery] int size = 10) {
var data = _context.Products .Skip((page - 1) * size) .Take(size) .ToList(); var totalCount = _context.Products.Count(); Response.Headers.Add("X-Total-Count", totalCount.ToString()); return Ok(data);
} ✅ Supports GET /api/products?page=2&size=5. 🔐 8. How to secure APIs with JWT tokens? Use JWT (JSON Web Token) authentication for stateless security. Setup in Program.cs: builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationS cheme) .AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = true, ValidIssuer = " ValidateAudience = true, ValidAudience = " IssuerSigningKey = new SymmetricSecurityKey( Encoding.UTF8.GetBytes("super-secret-key")) }; }); Then protect controllers: [Authorize] [ApiController] [Route("api/[controller]")] public class OrdersController : ControllerBase
{ [HttpGet] public IActionResult GetOrders() => Ok("Secure data");
} ⚡ 9. What is rate limiting in .NET 8? .NET 8 introduces built-in rate limiting middleware to control API request rates. Example: builder.Services.AddRateLimiter(options => { options.AddFixedWindowLimiter("fixed", opt => {
opt.PermitLimit = 5; // 5 requests
opt.Window = TimeSpan.FromSeconds(10); // per 10 seconds
var exception = context.Features.Get<IExceptionHandlerFeature>()?.Error; return Results.Problem(title: "Unexpected error", detail: exception?.Message); }); Or write a custom middleware for consistent error formatting. 🧾 11. How to use Swagger / OpenAPI? Swagger generates interactive API documentation automatically. Setup: builder.Services.AddEndpointsApiExplorer(); builder.Services.AddSwaggerGen(); var app = builder.Build();
if (app.Environment.IsDevelopment())
{ pp.UseSwagger(); pp.UseSwaggerUI(); } Run → Navigate to ✅ You can test endpoints directly from the browser. 🧰 12. What is NSwag or Swashbuckle? Both tools generate OpenAPI/Swagger documentation, but with slight differences: Tool Description Swashbuckle.AspNetCor Most common; adds Swagger UI, docs, and JSON schema NSwag Adds extra features like client SDK generation for C#/TypeScript Example (NSwag client generation): nswag openapi2csclient /input: /output:Client.cs 📤 13. How to upload files via Web API? Use IFormFile for file uploads. Controller Example: [HttpPost("upload")] public async Task<IActionResult> UploadFile(IFormFile file)
{
if (file == null || file.Length == 0)
return BadRequest("No file uploaded.");
var path = Path.Combine("wwwroot/uploads", file.FileName);
using var stream = new FileStream(path, FileMode.Create); wait file.CopyToAsync(stream); return Ok(new { file.FileName, file.Length });
} Client sends multipart/form-data POST requests. 🌐 14. How to implement CORS? CORS (Cross-Origin Resource Sharing) allows requests from other domains (e.g., frontend pps). Enable in Program.cs: builder.Services.AddCors(options => { options.AddPolicy("AllowReactApp", policy => policy.WithOrigins(" .AllowAnyHeader() .AllowAnyMethod()); }); var app = builder.Build(); pp.UseCors("AllowReactApp"); ✅ Now your React or Angular frontend can call your API safely. 🚀 15. What’s new in .NET 8 Minimal APIs? Minimal APIs let you build lightweight REST endpoints without controllers — great for microservices. Example: var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

Real-world example (ShopNest)

ShopNest admin screens use MVC: controller loads data, Razor view renders HTML, Tag Helpers build forms safely.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.