API Design
48 bites tagged API Design — interview questions with model answers, and 60-second explainers.
How do you mark a FastAPI endpoint as deprecated?
This tests decorator-level OpenAPI configuration in FastAPI. Pass deprecated=True to the path operation decorator, e.g. @app.get("/old", deprecated=True), so Swagger UI shows a strikethrough. Red flag: burying a deprecation warning in the docstring instead.
Explain SQLAlchemy ORM vs Pydantic models in FastAPI
This tests separation of database schema from API contracts. A strong answer distinguishes SQLAlchemy table rows from Pydantic validation and OpenAPI generation, and notes that create schemas exclude auto-generated IDs.
How would you implement a dependency requiring multi-source parameters?
Tests if you know FastAPI resolves dependency params like endpoint params. Great answers annotate each parameter with its source inside the dependency so FastAPI injects them independently. Red flag: manually parsing Request or merging values in the endpoint.
Implement a custom exception handler to catch ItemNotFoundError and return 404
Tests FastAPI exception handler registration beyond HTTPException. A strong answer covers creating a custom exception, using app.exception_handler, and returning a JSONResponse with status 404 and a structured body. Red flag: per-route try/except, plain dict.
Define a FastAPI endpoint with path and query parameters
Tests if you know FastAPI infers parameter location from the route string. Good answer: route with {item_id}, signature item_id: int, q: str | None = None, noting any param not in the path becomes a query param.
How would you use a Pydantic response_model to enforce output structure?
Tests separation of internal models from API contracts. Define a Pydantic output model with only safe fields, set it as the endpoint response_model, and let FastAPI filter and validate.
How do you prevent password_hash from appearing in a FastAPI response?
Tests FastAPI response filtering and the security practice of separating DB schemas from API contracts. A strong answer proposes a dedicated output model omitting the field, then cites response_model_exclude. Red flag: manual dict deletion or monkey-patching.
How does Pydantic handle extra JSON fields, and how to configure it?
This tests Pydantic's data filtering behavior and configuration. By default, Pydantic ignores extra fields silently. Set model_config = ConfigDict(extra='forbid' or 'allow') to change it. A red flag is claiming FastAPI 422s by default on unknown fields.
How do you define a Pydantic model for FastAPI request body validation?
Subclass BaseModel with id int, email str, full_name str|None; pass it as a route param so FastAPI validates JSON and returns 422s. Schema validation via Python type hints. Saying manual request.json() parsing.
What standard and code elements power FastAPI's auto-generated API docs?
Tests whether you know FastAPI uses the OpenAPI standard and extracts metadata from Python type hints, Pydantic models, decorators, and docstrings to build interactive docs. Red flag: claiming you must manually maintain a separate schema file.
How does FastAPI distinguish required optional and default query parameters
Tests whether you know FastAPI infers query parameter optionality from Python signature defaults. Answer: no default means required, Optional[T] = None means optional, T = value sets a default, with all three in one signature.
Explain Python type hints and their importance in FastAPI
Define hints as declarations; explain FastAPI uses them with Pydantic to validate requests and OpenAPI docs. If you know FastAPI uses type hints for validation and docs. Seeing hints as IDE-only.
Overriding FastAPI's OpenAPI Generator
FastAPI lets you swap app.openapi to reshape its generated schema without forking. Use this for vendor extensions, filtered operations, or merging external schemas. Forgetting to cache the result means every docs request rebuilds it and destroys performance.
What is the purpose of the internal directory in Go?
Tests Go visibility boundaries beyond exported vs unexported. A strong answer states that internal is compiler-enforced module privacy, while lowercase is only package-private. Red flag: calling internal a naming convention rather than a build boundary.
What type replaces String for read-only function parameters in Rust?
Use &str; it borrows without ownership, accepts literals and String via coercion, and avoids clones. Knowledge of Rust's read-only string view and API ergonomics.
Design a rate-limited REST API data collection script
Tests client-side throttling discipline versus reactive 429 handling. Strong answers proactively pace calls using rate-limit headers, cap concurrency, and apply exponential backoff with jitter. Red flag: tight-loop retries or ignoring headers.
Structure a 5-minute video script demonstrating a new API endpoint
Tests your ability to sequence technical information for developers with limited attention. Strong outline: 60s problem hook, 90s live request demo, 60s auth and errors, 30s next steps. Red flag: opening with PRD specs before a working call.
Design a simple templating system for ad copy generation
Tests separation of concerns and API design. A good answer: data model separate from template, placeholder syntax, graceful missing-value handling, and HTML escaping. Red flag: naive string concatenation without validation or extensibility.
Design a content gap tool: data sources and core logic
Tests system design for SEO pipelines. Strong answers cite APIs (Ahrefs, Semrush, GSC), explain normalization, and frame logic as a left-anti-join on keyword plus geo and device filtered by rank. Red flag: dismissing API cost, rate limits, and freshness.
Design architecture for multi-channel article distribution from a single source of truth
Tests separation of content and presentation via headless CMS. Strong answers cite a central structured CMS, content API, channel-specific rendering layers, and webhook push. Red flag: manual duplication or direct database sharing without API abstraction.
Design a content versioning system with history and revert
Versions table with article_id, version_num, content_snapshot, timestamp; APIs for createVersion, getHistory, restoreVersion. Can you model immutable history simply? Diff-only storage without latest lookup or mutating rows in place.
What problem can a breaking API change cause during a rolling update?
Tests if you know rolling updates run mixed versions, so breaking API changes crash cross-traffic. Good answer: note old and new pods serve together, watch probes fail, and monitor 5xx spikes. Red flag: claiming Kubernetes isolates versions during rollout.
Explain Kotlin's declaration-site variance with in and out
Out T means covariant producer (read), in T means contravariant consumer (write), removing wildcard noise. Understanding declaration-site variance versus wildcards. Confusing in/out with bounds or claiming immutability.
Kotlin's Type-Safe Builders: Code as Data
Type-safe builders use Kotlin code to create a custom language (DSL) for building complex objects. It's like writing HTML, but the compiler validates your structure. This is common for UI layouts or server configs. The footgun is omitting `@DslMarker`.
Get API Design bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.