API Testing (Postman, REST, GraphQL) Interview Questions and Answers (2025) | JaganInfo

An API (Application Programming Interface) is a set of protocols and tools for building software and allowing communication between different software components or systems.

REST (Representational State Transfer) is an architectural style for designing scalable web services that use HTTP methods and stateless communication.

Postman is a popular API testing tool used to create, send, and automate HTTP requests and verify responses.

GET (retrieve), POST (create), PUT (update/replace), PATCH (partial update), and DELETE (remove).

GraphQL is a query language and runtime for APIs allowing clients to request only the data they need, improving efficiency and flexibility.

An endpoint is a specific URL at which a client can access resources or services provided by the API.

JSON and XML are the most common data formats used for transferring data via APIs.

Status code 200 means OK, indicating a successful HTTP request.

Stateless means each API request from client to server must contain all information to understand and process the request independently.

Authentication verifies the identity of a user or application trying to access the API.

By creating requests with appropriate HTTP methods, adding headers/body, sending the requests to endpoints, and verifying status codes, headers, and response body.

API versioning controls changes to the API without breaking existing clients; it allows maintaining backward compatibility.

PUT updates or replaces the entire resource; PATCH modifies only specified parts of the resource.

Basic Auth, OAuth 2.0, API Keys, JWT, and Bearer tokens.

By checking HTTP status codes, response body content, headers, response time, and data types against expected results.

Schema validation ensures the API response follows the predefined format, data types, and structure such as JSON Schema or GraphQL schema.

Using Postman Collections and the built-in Newman CLI tool to run tests in continuous integration environments.

Queries fetch data from the server; mutations modify data or perform server-side actions.

They store reusable values for use across multiple requests — environment variables are tied to specific environments while global variables apply across all collections.

By analyzing response time, throughput, and running tests under different loads (with the help of external tools or Postman monitors).

By validating error status codes, error messages, and handling edge cases like timeouts or invalid inputs gracefully.

Test for authentication, authorization, injection attacks, data encryption, and rate limiting to prevent abuse.

Cross-Origin Resource Sharing (CORS) controls how web browsers allow requests from different origins; testing ensures APIs correctly handle or restrict such requests.

API gateways manage request routing, authorization, rate limiting, analytics, and can enforce security policies at the API boundary.

Mocking simulates API responses to test client applications or workflows without depending on actual API availability.

GraphQL testing includes validating schemas, queries, mutations, subscriptions, and ensuring clients get only requested data efficiently.

By creating reusable, maintainable test scripts and integrating them into CI/CD pipelines for frequent execution.

Pre-request scripts execute before a request to set variables or conditions; tests run after a response to validate outputs.

Using URL versioning, request header versioning, or content negotiation to provide backward-compatible API upgrades.

By logging defects with detailed request/response info, steps to reproduce, severity, and assigning for timely fixes.

Use automated security scanners, penetration testing, verify input sanitization, enforce strong authentication flows, and monitor for abnormal activity.

Simulate expected loads for load testing and progressively increase requests beyond capacity for stress testing while monitoring response times and failure rates.

Ensures that API providers and consumers adhere to a shared contract specifying requests and responses, preventing integration issues.

Use tools to track uptime, response time, error rates, traffic usage, and alert on anomalies to maintain SLA compliance.

Test real-time updates pushed from the server by establishing websocket connections and validating event streams.

API mocking simulates services allowing parallel development and testing when backend services are unavailable or unstable.

Idempotent APIs allow the same operation to be performed multiple times without additional side-effects, ensuring safe retries and fault tolerance.

By ensuring all endpoints, HTTP methods, parameter combinations, error conditions, and authorization scenarios are tested.

Keep tests modular, reusable, maintain clear documentation, integrate with CI/CD, handle dynamic data, and review tests for flaky behavior.

Simulate high-frequency API calls to ensure limits are enforced and appropriate error codes like 429 are returned on exceeding thresholds.