Interview Q&A

Short answer: A redirect tells the client to fetch a resource from a different URL. 301 Moved Permanently → Resource moved permanently (update bookmarks/links). 302 Found → Temporary redirect (use current URL for future requests).

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: In REST, resources (like users, products, orders) are identified with URLs instead of actions. 👉 Example in ASP.NET Core Web API: // Instead of action-based GET /getUser?id=1 // Use resource-based GET /users/1 This makes APIs cleaner and more intuitive.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Statelessness → No server memory required for client sessions → Easy to scale horizontally. Layered System → Load balancers, caching layers can be added without changing API. Uniform Interface → Predictable, decouples client and server. Cacheability → Reduces server load.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: (With C# ASP.NET Core Web API example) Discoverability means clients can navigate and learn available actions through metadata or hypermedia links, without hardcoding routes. 👉 Example using HATEOAS in ASP.NET Core Web API: [HttpGet("users/{id}")] public IActionResult GetUser(int id)

Example code

{
var user = new { Id = id, Name = "Alice" };
var response = new
{ user, links = new[] { new { rel = "self", href = Url.Action("GetUser", new { id }) }, new { rel = "orders", href = Url.Action("GetUserOrders", new { id }) } } }; return Ok(response);
} The API response itself guides the client to related resources (user’s orders, profile, etc.). Q&A

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Discoverability means clients can navigate and learn available actions through metadata or hypermedia links, without hardcoding routes.

Explain a bit more

👉 Example using HATEOAS in ASP.NET Core Web API: [HttpGet("users/{id}")] public IActionResult GetUser(int id) { var user = new { Id = id, Name = "Alice" }; var response = new { user, links = new[] { new { rel = "self", href = Url.Action("GetUser", new { id }) }, new { rel = "orders", href = Url.Action("GetUserOrders", new { id }) } } }; return Ok(response); } The API response itself guides the client to related resources (user’s orders, profile, etc.). var response = new { user, links = new[] { new { rel = "self", href = Url.Action("GetUser", new { id }) }, new { rel = "orders", href = Url.Action("GetUserOrders", new { id }) } } }; return Ok(response); } The API response itself guides the client to related resources (user’s orders, profile, etc.). Q&A

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use resource-based URLs (/users/1/orders) not action-based (/getUserOrders). ● Return proper status codes (200, 201, 400, 404, 500). Support pagination & filtering for large data. Implement authentication & authorization (JWT, OAuth2). Ensure statelessness. Provide versioning (v1, v2). Secure API with HTTPS only.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use nouns, not verbs → GET /users (not /getUsers). Use plural form → /users, /orders. Nested resources for relationships → /users/1/orders. Consistent naming conventions. Avoid exposing internal DB structure.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Consistency in naming and responses. Error handling with meaningful messages. Security (HTTPS, JWT, OAuth2). Scalability (statelessness, caching). Performance (pagination, filtering). Documentation (Swagger/OpenAPI).

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Return proper status codes and a structured error object: 👉 Example in ASP.NET Core: { "status": 400, "error": "Invalid Request", "details": "Email field is required" }

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Prevents large payloads. Improves performance and response times. Reduces server and network load. 👉

Example code

GET /users?page=2&limit=20.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Authentication → API Keys, JWT, OAuth2. Authorization → Role-based access control. Always use HTTPS. Validate input & sanitize data. Prevent SQL injection, XSS, CSRF.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Provide versioning. Send Deprecation warning headers. Maintain old versions temporarily. Give developers migration guides.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthentication? Pros: Secure delegated access. Widely adopted (Google, Facebook, GitHub). Works well for 3rd-party apps. Cons: Complex implementation. Requires token management. Overhead for small/simple APIs.

Real-world example (ShopNest)

ShopNest mobile app sends a JWT Bearer token. The API validates it and uses the user id from claims to load that user’s cart only.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Pros: Secure delegated access. Widely adopted (Google, Facebook, GitHub). Works well for 3rd-party apps. Cons: Complex implementation. Requires token management. Overhead for small/simple APIs.

Real-world example (ShopNest)

ShopNest mobile app sends a JWT Bearer token. The API validates it and uses the user id from claims to load that user’s cart only.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: GET, PUT, DELETE → Ensure repeated requests produce the same result. Avoid side effects on repeated requests. Use unique request IDs for POST (to prevent duplicate creation).

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: SQL Injection Cross-Site Scripting (XSS) Cross-Site Request Forgery (CSRF) Broken Authentication Insecure Direct Object References (IDOR) Unencrypted data transmission

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Always use parameterized queries / ORM (EF Core). Validate and sanitize input. Apply least privilege on DB users. 👉 Example in EF Core: var user = db.Users.FirstOrDefault(u => u.Email == email);

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Malicious sites could misuse APIs if CORS is too permissive. Always restrict origins (Access-Control-Allow-Origin). Avoid * in production. Use tokens for security.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use structured logging (Serilog, NLog). Log important events (auth failures, errors, requests). Implement monitoring tools (Application Insights, ELK Stack). Add correlation IDs for tracing requests.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: URI Versioning → /api/v1/users Header Versioning → Accept: application/vnd.myapi.v2+json Best practice: URI versioning for clarity.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: XML YAML CSV Protocol Buffers (gRPC) Plain text

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Webhooks are server-to-server callbacks triggered by events. 👉 Example: Stripe API calls your endpoint /payment/confirmed when a payment succeeds.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Always return limited results (avoid huge payloads). Provide page and limit parameters → /users?page=2&limit=20. Return metadata → { "page": 2, "totalPages": 10 }. Support cursor-based pagination for large datasets.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use tools like Postman Collections, Newman, RestAssured (Java), Supertest (Node.js), xUnit/NUnit (C#). Integrate tests into CI/CD pipelines (Jenkins, GitHub Actions, Azure DevOps). Automate unit, integration, and load tests. Ensure regression testing after deployments.

Real-world example (ShopNest)

ShopNest exposes REST APIs for cart and checkout. Controllers stay thin; business rules live in application services.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Async Processing → Return 202 Accepted with a status URL (/jobs/{id}). Client polls the status endpoint until job is complete. Optionally use Webhooks for notifying clients. 👉 Example: File processing, report generation.

Real-world example (ShopNest)

Creating an order is POST /api/orders → 201 with Location header. Fetching is GET /api/orders/{id} → 200 or 404.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.