API / Backend Testing

Know Content-Type/Accept/Authorization/custom headers and where each param lives.

Asked Live coding: 'construct this request and verify it'; whiteboard the anatomy of an HTTP request

named in the job descriptions

Name every method, its intent, which are idempotent/safe, and why it matters for retries and test design.

Asked 'Difference between PUT and PATCH? Which methods are idempotent?' (Q1 in question bank)

named in the job descriptions

Recall the common codes without hesitation and explain the semantically tricky ones.

Asked 'Explain 401 vs 403. What does 429 mean and how do you test rate limiting?' (Q2)

asked in interviews, not named in any job description

Assert all four dimensions of a response, not just the status code.

Asked 'What do you assert on an API response?' (expect the four-dimension answer)

named in the job descriptions

Attach Basic credentials / API keys correctly and test missing/invalid key paths.

Asked 'How do you handle auth in your API suite?'

named in the job descriptions

Decompose header.payload.signature, read claims/exp, and test around token validity.

Asked 'What is in a JWT? How do you test an endpoint needing a valid vs expired token?' (Q3)

named in the job descriptions

Describe the flows conceptually and how you obtain/refresh/expire a token in a suite.

Asked 'Walk through the OAuth2 flow you have tested. How do you handle token refresh in your suite?' (Q4)

named in the job descriptions

Verify authorization boundaries per role, not just authentication.

Asked 'How do you test that an endpoint enforces permissions correctly?'

named in the job descriptions

Assert the response SHAPE, not only values, to catch contract drift.

Asked 'How do you validate a response schema, not just values? Why bother?' (Q6)

named in the job descriptions

Articulate consumer-driven contracts, the broker, and why contract testing beats brittle E2E for microservices.

Asked 'Walk me through setting up contract testing between a frontend and three backend services.' (Q10, documented common Q)

named in the job descriptions

Treat the OpenAPI spec as source of truth and auto-generate/validate tests from it.

Asked 'How would you catch contract drift before it hits prod?' / spec-driven testing follow-up

named in the job descriptions

Tests are repeatable and independent; created data is torn down.

Asked 'How do you make your API tests repeatable / independent?'

named in the job descriptions

Extract a value from response N and feed request N+1 across a full resource lifecycle.

Asked 'How do you do API chaining?' + live coding: full CRUD lifecycle with chaining + assertions (Q5, Section-3 live round)

named in the job descriptions

Drive one test across many input rows instead of copy-pasting cases.

Asked 'How do you avoid duplicating tests across many inputs?' (often folded into the live coding task)

named in the job descriptions

Systematically test invalid payloads, missing/expired auth, wrong types, boundaries, malformed JSON.

Asked 'How would you write negative tests for a POST endpoint? Give edge cases.' (Q7)

named in the job descriptions

Know how GraphQL testing differs from REST and its classic gotchas.

Asked 'GraphQL: how does testing differ from REST?' (Q15) — single endpoint, 200-with-errors, field auth

named in the job descriptions

Name the 4 RPC types, the .proto contract, and gRPC status codes; test with grpcurl/Postman gRPC.

Asked 'Have you tested gRPC? How does it differ from REST testing?' (only in high-scale/product cos)

named in the job descriptions

Know how to test a persistent bidirectional connection and message flow.

Asked 'How would you test a WebSocket / real-time endpoint?' (niche, fintech/crypto)

named in the job descriptions

Fluent authoring of collections with assertions and running them headless in CI.

Asked 'Postman vs REST Assured — when each? What is Newman?' (Q8)

named in the job descriptions

Design a clean requests+Pytest API framework fluently — his home turf.

Asked Live coding round in Python; 'walk me through your API framework structure'

named in the job descriptions

Read REST Assured code and speak to its BDD structure even though he automates in Python.

Asked 'In REST Assured, explain given().when().then() and POJO serialization.' (Q9, Java shops)

named in the job descriptions

Run API suites automatically in the pipeline and gate merges on results.

Asked 'How do you run API tests in CI/CD?' (Q14)

named in the job descriptions

Smoke-test an SLA and speak to latency/throughput percentiles without being a perf specialist.

Asked 'How would you load-test an endpoint and assert an SLA?' (Q16)

named in the job descriptions

Stub an upstream dependency and inject errors/latency/timeouts to test resilience.

Asked 'When and how do you mock/stub a dependency?' (Q12)

named in the job descriptions

Frame API testing inside a coherent microservices test strategy — the biggest SDET-2 differentiator.

Asked 'How do you test microservices — your strategy across unit/integration/contract/E2E?' (Q11)

named in the job descriptions

Verify a UI action triggers the correct API call and the correct DB state — triangulation few candidates do.

Asked 'How do you validate UI action -> API -> DB consistency?' (Q13)

named in the job descriptions

Test that producing an event yields the correct downstream state, without becoming a Kafka engineer.

Asked 'How would you test an event-driven / queue-based flow?'

named in the job descriptions

Recognize the top API security risks and where they belong in the pipeline.

Asked 'What API security risks do you test for?' (~10% of modern interviews)

named in the job descriptions

Debug a failing API test using logs and distributed traces, signalling operational maturity.

Asked 'How do you debug a flaky/failing API test in CI?'

asked in interviews, not named in any job description

Speak from doing it: using LLMs/agents to generate and maintain API tests.

Asked 'How are you using AI in your testing?' (2026 interviews explicitly probe this)

named in the job descriptions

Architect the test system, not the product — the modern SDET-2 design round.

Asked 'Design a test framework for a microservices platform' / 'architect a CI/CD pipeline for 500 daily test runs' (web 2026)

named in the job descriptions