Top 30 API Design Interview Questions and Answers

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   When you annotate a FastAPI route parameter with a Pydantic model, what does the framework do with that type hint?

   • aIt leverages the hint for automatic request validation and OpenAPI schema generation
   • bIt uses the hint to enforce types at runtime via Python's built-in type checker
   • cIt passes the hint to the IDE but performs no framework-level request handling
   • dIt ignores the hint and expects manual validation logic inside the route function
   Show the answer

   Answer: a · It leverages the hint for automatic request validation and OpenAPI schema generation

   FastAPI reads type hints at startup to construct Pydantic models that validate incoming requests and generate OpenAPI schemas automatically. The distractor about runtime enforcement is wrong because Python itself ignores type hints during execution unless an external tool checks them.

   Read the full bite: Explain Python type hints and their importance in FastAPI

2. Question 2 of 30

   What single element most reduces churn when documenting a breaking API change for developers?

   • aA celebratory tone emphasizing new features
   • bA longer, fully chronological changelog of every commit
   • cRemoving mention of the old behavior entirely
   • dConcrete before-and-after migration steps for each breaking change
   Show the answer

   Answer: d · Concrete before-and-after migration steps for each breaking change

   Developers churn when they cannot see how to fix their code; explicit before-and-after migration steps give a direct, actionable path. A celebratory tone or hiding the old behavior leaves users stranded and increases frustration.

   Read the full bite: Structuring release notes for breaking API changes

3. Question 3 of 30

   An endpoint declares a query parameter as q: Optional[str] with no default value. What happens when a client omits it?

   • aFastAPI automatically assigns None as the default based solely on the Optional type hint
   • bFastAPI follows Pydantic model conventions and defaults the parameter to None
   • cFastAPI returns a 422 Unprocessable Entity error
   • dFastAPI allows the request and sets q to None because the type hint permits None
   Show the answer

   Answer: c · FastAPI returns a 422 Unprocessable Entity error

   FastAPI derives requirement from the presence or absence of a Python signature default, not from type hints, so Optional[str] without = None is still required and omitting it triggers a 422 error. Option D is a common misconception because Optional alone does not make a parameter optional in FastAPI.

   Read the full bite: How does FastAPI distinguish required optional and default query parameters

4. Question 4 of 30

   What combination of standard and code sources enables FastAPI's automatic interactive documentation?

   • aIt generates a static JSON schema at build time from explicit annotations only
   • bIt requires manually maintaining an openapi.yaml file alongside your code changes
   • cIt uses the Swagger UI standard to parse docstrings without needing type hints
   • dIt dynamically builds an OpenAPI schema from type hints, Pydantic models, decorators, and docstrings
   Show the answer

   Answer: d · It dynamically builds an OpenAPI schema from type hints, Pydantic models, decorators, and docstrings

   FastAPI dynamically generates an OpenAPI schema by extracting metadata from type hints, Pydantic models, decorators, and docstrings, so no manual schema file is required. Option B is wrong because maintaining a separate openapi.yaml by hand is unnecessary and contradicts FastAPI's design.

   Read the full bite: What standard and code elements power FastAPI's auto-generated API docs?

5. Question 5 of 30

   What is the primary type-system benefit of declaring an interface as Producer<out T> when T only appears in return positions?

   • aIt allows Producer<Any> to be safely assigned to a variable of type Producer<String>.
   • bIt lets Producer<String> be used where Producer<Any> is expected without caller-side wildcards.
   • cIt makes the class immutable by preventing any state modifications.
   • dIt enforces an upper inheritance bound on T so only subtypes of a specific class may be used.
   Show the answer

   Answer: b · It lets Producer<String> be used where Producer<Any> is expected without caller-side wildcards.

   Marking T with out makes Producer covariant, so Producer<String> is a subtype of Producer<Any> and callers never need wildcards. Option C is wrong because variance does not imply immutability; the class may still mutate state via operations that do not mention T.

   Read the full bite: Explain Kotlin's declaration-site variance with in and out

6. Question 6 of 30

   Which method correctly enables automatic JSON body validation in a FastAPI route?

   • aSubclass BaseModel and declare it as the type of a path operation function parameter
   • bSubclass BaseModel and set it as the response_model in the route decorator
   • cUse a standard Python dataclass as the type annotation for the route parameter
   • dCall await request.json() manually and instantiate the Pydantic model inside the handler
   Show the answer

   Answer: a · Subclass BaseModel and declare it as the type of a path operation function parameter

   FastAPI inspects path operation parameter type annotations to automatically parse and validate incoming JSON against a Pydantic BaseModel. Manually calling request.json() bypasses this automatic pipeline, and response_model only defines the outgoing response schema rather than request validation.

   Read the full bite: How do you define a Pydantic model for FastAPI request body validation?

7. Question 7 of 30

   You want a Rust function to read a string without taking ownership and accept both a String variable and a literal. Which parameter type achieves this?

   • astr
   • b&str
   • c&String
   • dString
   Show the answer

   Answer: b · &str

   &str is a borrowed slice that coerces from &String and accepts literals directly, avoiding clones. &String is wrong because it rejects string literals, forcing callers to allocate a String they do not need.

   Read the full bite: What type replaces String for read-only function parameters in Rust?

8. Question 8 of 30

   When a FastAPI endpoint receives JSON with extra fields not defined in the Pydantic model, what occurs by default?

   • aPydantic stores the extra fields in __pydantic_extra__ and continues validation
   • bFastAPI returns a 400 Bad Request before Pydantic validates the payload
   • cPydantic raises a ValidationError causing FastAPI to return a 422 response
   • dPydantic silently drops the extra fields and the request succeeds
   Show the answer

   Answer: d · Pydantic silently drops the extra fields and the request succeeds

   By default Pydantic ignores extra fields, silently dropping them so the model instantiates and the request succeeds. Option C is wrong because that strict 422 behavior only happens when you explicitly configure extra to forbid in model_config.

   Read the full bite: How does Pydantic handle extra JSON fields, and how to configure it?

9. Question 9 of 30

   You define a function return type as Product[] | { message: string }. What is the critical next step before using the returned value?

   • aCast the result to any to simplify downstream code
   • bForce consumers to use type assertions or defensive checks on the union
   • cExport the union but let consumers decide how to narrow it
   • dUse a type guard such as Array.isArray to narrow the union
   Show the answer

   Answer: d · Use a type guard such as Array.isArray to narrow the union

   Using a type guard like Array.isArray lets TypeScript narrow the union inside each branch, giving exact types and autocomplete. Simply returning the union without narrowing forces consumers to deal with both shapes manually, a subtler error that hides bugs until runtime.

   Read the full bite: How do you type a function with two possible response shapes?

10. Question 10 of 30

    Which is the strongest reason to prefer a string enum over a numeric enum for a status field returned by an external API?

    • aString enums use human-readable runtime values that match the API wire format exactly, avoiding an extra mapping layer.
    • bString enums support reverse mapping from value to name, while numeric enums do not.
    • cString enums auto-increment their values, making it easier to add new statuses without explicit initialization.
    • dString enums generate smaller compiled JavaScript output and have zero runtime overhead compared to numeric enums.
    Show the answer

    Answer: a · String enums use human-readable runtime values that match the API wire format exactly, avoiding an extra mapping layer.

    String enums let you assign API response values directly because their runtime values are the exact strings on the wire, unlike numeric enums which produce opaque integers and require a separate mapping. The most tempting distractor claims string enums offer reverse mapping, but that is actually a feature of numeric enums and is usually irrelevant for external API contracts.

    Read the full bite: How would you use an enum to represent API statuses?

11. Question 11 of 30

    Which TypeScript structure should you choose to make an ApiResponse<T> that cannot simultaneously hold both data and error properties?

    • aA single interface with optional data?: T and error?: { code; message; } alongside status: string
    • bA generic interface using a boolean isError flag with optional data?: T and error?: { code; message; }
    • cA single interface with required data: T and error: { code; message; } and status: "success" | "error"
    • dA union of two interfaces sharing a status literal, one generic branch with data: T and the other with error: { code; message; }
    Show the answer

    Answer: d · A union of two interfaces sharing a status literal, one generic branch with data: T and the other with error: { code; message; }

    A discriminated union with a shared literal status makes it impossible to represent both states at once and enables automatic type narrowing. Option A is a common mistake because optional fields and a broad string status allow objects where both data and error are present, absent, or mismatched.

    Read the full bite: Write a generic ApiResponse<T> type with success and error states

12. Question 12 of 30

    In the two-table versioning design, what is the main benefit of storing current_version_id in the articles table?

    • aIt serves as a diff baseline to reconstruct any version from deltas
    • bIt enforces referential integrity between articles and their versions
    • cIt lets the application fetch the latest article state without scanning the full version history
    • dIt records the original author who created the article
    Show the answer

    Answer: c · It lets the application fetch the latest article state without scanning the full version history

    The correct answer is C because the pointer provides immediate access to the current snapshot, avoiding costly history scans. Distractor B is wrong since the design intentionally stores full snapshots rather than relying on diff reconstruction for lookups.

    Read the full bite: Design a content versioning system with history and revert

13. Question 13 of 30

    A FastAPI endpoint returns a UserDB model containing password_hash. Which strategy best prevents exposing the hash while keeping the API contract explicit and maintainable?

    • aSet password_hash to None in the endpoint body before returning the UserDB instance.
    • bUse response_model_exclude={"password_hash"} on the decorator to omit the field during serialization.
    • cCreate a separate UserOut model without password_hash and set response_model=UserOut on the endpoint.
    • dCall user.model_dump(exclude={"password_hash"}) and return the raw dict from the endpoint.
    Show the answer

    Answer: c · Create a separate UserOut model without password_hash and set response_model=UserOut on the endpoint.

    A dedicated output model declaratively isolates the API contract from the database schema and prevents accidental leaks if new sensitive fields are added later. Option B is a tempting quick fix, but it keeps the sensitive field in the source model and hides the contract outside the type system, making it harder to maintain.

    Read the full bite: How do you prevent password_hash from appearing in a FastAPI response?

14. Question 14 of 30

    In a decoupled multi-channel architecture, how should article content be stored and delivered to consumers?

    • aIn the website's database with direct SQL access granted to mobile and email services
    • bAs a single shared HTML blob rendered identically by all channels
    • cAs rich text only, requiring each channel to parse the unstructured content for its own needs
    • dIn structured, channel-agnostic fields exposed via an API with channel-specific rendering layers
    Show the answer

    Answer: d · In structured, channel-agnostic fields exposed via an API with channel-specific rendering layers

    Storing content in structured, channel-agnostic fields and delivering it through an API lets each channel render appropriately, while a shared HTML blob is tempting but wrong because forcing identical presentation breaks mobile layouts and email compatibility.

    Read the full bite: Design architecture for multi-channel article distribution from a single source of truth

15. Question 15 of 30

    What is the immediate output of a successfully executed Kotlin type-safe builder block?

    • aA hierarchical tree of interconnected Kotlin objects representing the defined structure.
    • bA set of validation rules ensuring that the generated structure adheres to specific type constraints.
    • cA string formatted according to the builder's structure, such as HTML or XML.
    • dA compiled DSL definition that can be reused to generate various data structures.
    Show the answer

    Answer: a · A hierarchical tree of interconnected Kotlin objects representing the defined structure.

    The card explicitly states that a builder block "doesn't generate a string" but rather "instantiate and link HTML, Head, and Title objects into a tree," with the "final result is a root HTML object." While builders are often used to eventually produce strings, their immediate output is an object hierarchy. Option C is a common misconception because builders are frequently used for markup generation.

    Read the full bite: Kotlin's Type-Safe Builders: Code as Data

16. Question 16 of 30

    Which approach is the idiomatic TypeScript solution for constructing a typesafe ApiRoute type that includes both /api/v1/<resource> collection paths and /api/v1/<resource>/{id} item paths from a finite Resource union?

    • aA mapped type over Resource that assembles routes into an object, then indexed with Resource to extract the union
    • bA base route template interpolating Resource into /api/v1/, unioned with the same base route suffixed by /{id}
    • cAn open-ended template literal that uses the string type in the resource position to avoid updating types when resources change
    • dA runtime regex inside the API client that validates paths and casts the result to ApiRoute
    Show the answer

    Answer: b · A base route template interpolating Resource into /api/v1/, unioned with the same base route suffixed by /{id}

    Template literal types automatically distribute a union through an interpolated position into every concrete string permutation, so unioning BaseRoute with BaseRoute/{id} is the idiomatic, machinery-free solution. Option A is tempting because it yields the same members, but it unnecessarily uses a mapped type when direct interpolation already expands the union, and C sacrifices compile-time exhaustiveness for false flexibility.

    Read the full bite: Build a typesafe ApiRoute type using template literal types

17. Question 17 of 30

    You move a helper package into an internal directory to restrict its use to your module. Which statement about the effects is true?

    • aExternal modules are blocked from importing it by the compiler, while sibling packages in the same module can still import it freely
    • bIt provides the same module-level privacy as using lowercase unexported identifiers in the helper package
    • cIt hides the package from all other packages, including those within the same module
    • dIt is a naming convention without compiler enforcement, relying only on team discipline
    Show the answer

    Answer: a · External modules are blocked from importing it by the compiler, while sibling packages in the same module can still import it freely

    The Go compiler rejects imports of internal packages from outside the module, yet packages inside the same module may import them normally. Option B is tempting because unexported identifiers also limit visibility, but they only restrict access within a single package, not across packages in a module.

    Read the full bite: What is the purpose of the internal directory in Go?

18. Question 18 of 30

    What happens to extra fields on an object returned by a FastAPI endpoint when a response_model is declared?

    • aFastAPI raises a validation error if the returned object contains undeclared fields
    • bFastAPI silently filters out fields not present in the response_model during serialization
    • cThe endpoint must manually remove extra fields before returning to avoid errors
    • dThe response_model must explicitly set extra='allow' to include additional fields
    Show the answer

    Answer: b · FastAPI silently filters out fields not present in the response_model during serialization

    The card explains that FastAPI automatically drops undeclared fields when serializing against the response_model. Option C represents the brittle manual approach the card explicitly warns against, whereas the response_model is designed to handle filtering for you.

    Read the full bite: How would you use a Pydantic response_model to enforce output structure?

19. Question 19 of 30

    In FastAPI, what primarily determines whether a function parameter is treated as a path parameter instead of a query parameter?

    • aThe parameter's position before any parameters that have default values
    • bIf the parameter name appears inside braces in the route path string
    • cExplicitly annotating the parameter with Path from the fastapi module
    • dWhether the parameter has a default value in the function signature
    Show the answer

    Answer: b · If the parameter name appears inside braces in the route path string

    FastAPI inspects the route path template and treats parameters named in braces as path variables, while all others become query parameters. Although Path() can add metadata, it is not required for basic inference, and default values determine optionality rather than parameter location.

    Read the full bite: Define a FastAPI endpoint with path and query parameters

20. Question 20 of 30

    What architectural choice best prevents a feature-rich DataTable from becoming a monolith with dozens of props?

    • aHardcoding cell rendering and exposing only a data prop
    • bA headless logic core plus a column-definition config with per-column render functions
    • cPutting all sorting and selection logic directly inside the render method
    • dAdding a boolean prop for every feature like sortable, selectable, and renderable
    Show the answer

    Answer: b · A headless logic core plus a column-definition config with per-column render functions

    Separating headless state from rendering and driving structure with column configs and render functions lets features scale via config rather than prop accretion. Per-feature booleans and hardcoded rendering are exactly what causes the monolith.

    Read the full bite: Architecting a composable DataTable API

21. Question 21 of 30

    Which client-side strategy best maximizes throughput for a 100 req/min API without triggering excessive 429 errors?

    • aLimit concurrency to four workers but send requests at full speed, using only reactive exponential backoff and ignoring rate-limit headers.
    • bBound concurrency to a small worker pool, proactively pace requests using rate-limit headers, and apply exponential backoff with jitter on 429s.
    • cKeep an unbounded number of workers and rely solely on reactive exponential backoff after receiving 429 responses.
    • dInsert a fixed one-second delay after every request and retry 429s with linear backoff while ignoring rate-limit headers.
    Show the answer

    Answer: b · Bound concurrency to a small worker pool, proactively pace requests using rate-limit headers, and apply exponential backoff with jitter on 429s.

    The correct answer combines proactive throttling, header-aware dynamic pacing, bounded concurrency, and resilient retries as described in the card. Option A is tempting because it limits concurrency, but it still creates burst traffic and ignores headers, relying on the server to punish the client rather than preventing 429s proactively.

    Read the full bite: Design a rate-limited REST API data collection script

22. Question 22 of 30

    Which of the following correctly implements a global FastAPI handler for a custom ItemNotFoundError that returns a structured 404 JSON response?

    • aDefine an async handler with signature (request: Request, exc: ItemNotFoundError), register it with @app.exception_handler, and return a JSONResponse with status_code=404 and structured content.
    • bDefine an async handler that takes only exc: ItemNotFoundError, decorate it with @app.exception_handler, and return a JSONResponse with status_code=404.
    • cWrap each route function in try/except ItemNotFoundError and return a JSONResponse with status_code=404.
    • dRaise HTTPException(status_code=404) directly from the service layer whenever an item is missing.
    Show the answer

    Answer: a · Define an async handler with signature (request: Request, exc: ItemNotFoundError), register it with @app.exception_handler, and return a JSONResponse with status_code=404 and structured content.

    The correct approach registers a global handler with the Starlette-injected request parameter and returns a proper JSONResponse, centralizing error handling across all routes. Option C is tempting because it uses the correct response type, but scattering try/except blocks in every route defeats the purpose of centralized exception handling and creates unnecessary duplication.

    Read the full bite: Implement a custom exception handler to catch ItemNotFoundError and return 404

23. Question 23 of 30

    In an SEO content gap pipeline, which operation and key set correctly isolates competitor keywords your domain does not rank for?

    • aLeft anti-join on keyword and landing page URL, keeping rows where the competitor ranks in the top 10
    • bLeft anti-join on keyword, geography, and device, filtering for competitor rank in the top 20 and your domain absent or below position 100
    • cInner join on keyword text alone, returning rows where the competitor outranks your domain in any region
    • dFull outer join on keyword and domain, surfacing all keywords from both datasets without rank thresholds
    Show the answer

    Answer: b · Left anti-join on keyword, geography, and device, filtering for competitor rank in the top 20 and your domain absent or below position 100

    A left anti-join on keyword, geography, and device with rank filters correctly finds competitor keywords you do not own. Option C is tempting because it compares rankings, but an inner join on keyword text alone ignores geo and device while returning shared terms rather than true gaps.

    Read the full bite: Design a content gap tool: data sources and core logic

24. Question 24 of 30

    You need a FastAPI dependency that combines a path parameter and a request header. What is the correct implementation pattern?

    • aUse a special @composite_dependency decorator on the function to tell FastAPI to resolve parameters from multiple request locations.
    • bInject the raw Request object into the dependency and manually read the path parameter and header from its scope and headers dictionary.
    • cExtract both values in the path operation endpoint and pass them into a plain helper function called directly from the endpoint.
    • dAnnotate each parameter in the dependency function with its source (e.g., Path, Header) and declare the function as a dependency with Depends().
    Show the answer

    Answer: d · Annotate each parameter in the dependency function with its source (e.g., Path, Header) and declare the function as a dependency with Depends().

    FastAPI inspects dependency signatures using the same resolution engine as endpoints, so annotating parameters with Path, Header, or similar and using Depends() lets the framework inject them automatically. Option B is tempting for developers familiar with lower-level frameworks, but manually parsing Request bypasses validation and defeats the purpose of FastAPI's dependency injection system.

    Read the full bite: How would you implement a dependency requiring multi-source parameters?

25. Question 25 of 30

    What is the strongest way to guarantee every icon-only Button has an accessible name?

    • aDocument in the README that icon buttons require an aria-label
    • bRender the icon's filename as the button's text
    • cAdd the label to a hover tooltip only
    • dUse a TypeScript discriminated union so the icon-only variant makes aria-label a required prop
    Show the answer

    Answer: d · Use a TypeScript discriminated union so the icon-only variant makes aria-label a required prop

    Making the label required at the type level turns omission into a compile error, the strongest guarantee. Documentation is ignorable, filenames are meaningless to users, and tooltip-only labels are not reliably announced by screen readers.

    Read the full bite: Enforcing an accessible name on icon-only buttons

26. Question 26 of 30

    An API returns 200 OK for every successful response, including resource creation. What semantic information is being lost?

    • aThat a new resource was created, which 201 (with a Location header) signals
    • bThat the response is cacheable
    • cThat the request was authenticated
    • dThat the body is JSON
    Show the answer

    Answer: a · That a new resource was created, which 201 (with a Location header) signals

    201 Created communicates that a new resource now exists and where to find it via Location; a generic 200 hides that distinction. Auth, caching, and content type are conveyed by other mechanisms.

    Read the full bite: Status codes for successful POST and GET

27. Question 27 of 30

    When an API returns HTTP 200 for both success and failure, which strategy best enforces type safety across the network boundary?

    • aInspect whether the data property exists on the body to decide if the response represents success or error
    • bTreat the body as unknown, use a type guard to validate it against a discriminated union, and wrap the outcome in a Result type
    • cCast the parsed JSON to the success interface using as immediately after response.json() to satisfy the compiler
    • dReturn the parsed JSON as any and let the caller check body.status to determine which branch to use
    Show the answer

    Answer: b · Treat the body as unknown, use a type guard to validate it against a discriminated union, and wrap the outcome in a Result type

    Treating the body as unknown and validating it with a type guard forces runtime checks and enables narrowing to a discriminated union, which a Result type then surfaces to callers. Casting with as is dangerous because it bypasses both runtime validation and the type checker, allowing error payloads to be treated as success data.

    Read the full bite: How do you handle an API returning 200 for success and failure?

28. Question 28 of 30

    A mobile client retries a request after a network timeout. Which request can it safely retry without risking duplicate resources?

    • aAny request, since HTTP retries are always safe
    • bPUT /users/42 with the full updated representation
    • cPOST /orders to place an order
    • dPOST /users with a new user payload
    Show the answer

    Answer: b · PUT /users/42 with the full updated representation

    PUT to a known URL is idempotent, so a retry converges to the same state. POST is not idempotent, so retrying it can create duplicate users or orders.

    Read the full bite: Idempotency: PUT vs POST in REST

29. Question 29 of 30

    In an Express 4 API with a central error middleware, async route errors still hang the request while sync throws work fine. What is missing?

    • aA second error-handling middleware
    • bAn asyncHandler wrapper that catches promise rejections and calls next
    • cA try/catch inside the error middleware itself
    • dRegistering the error handler before the routes
    Show the answer

    Answer: b · An asyncHandler wrapper that catches promise rejections and calls next

    Express 4 auto-catches synchronous throws but not promise rejections, so async handlers need a wrapper that forwards rejections to next. Moving the error handler before routes would actually break it.

    Read the full bite: Centralized error handling in an Express API

30. Question 30 of 30

    What is the strongest argument against adding a variant only one team needs directly into the core library?

    • aIt permanently enlarges the API surface the core team must maintain for low reuse
    • bIt would require a major version bump every time
    • cCore libraries technically cannot hold optional variants
    • dOne-off variants cannot be made accessible
    Show the answer

    Answer: a · It permanently enlarges the API surface the core team must maintain for low reuse

    A single-team variant adds lasting maintenance and API-surface cost for little reuse, the core bloat concern. Adding a variant is typically a minor bump, not major, and accessibility and optional variants are both perfectly achievable.

    Read the full bite: Deciding whether a one-off variant belongs in core