API testing quiz: 20 questions with explanations

Which set contains only idempotent HTTP methods?

• GET, POST, DELETE
• POST, PATCH
• GET, PUT, DELETE
• POST, PUT

Answer: GET, PUT, DELETE. Idempotent means repeating the request leaves the server in the same state as doing it once. GET, PUT and DELETE are defined that way. POST normally creates a new resource each time.

You want to change only the phone number of a user and leave other fields as they are. Which method fits best?

• PATCH
• PUT with only the phone field
• POST to /users
• DELETE then POST

Answer: PATCH. PATCH applies a partial update. PUT replaces the whole resource, so sending only one field with PUT risks clearing the others.

Which header tells the server that the request body is JSON?

• Accept: text/json
• Authorization: json
• Body-Type: json
• Content-Type: application/json

Answer: Content-Type: application/json. Content-Type describes the body you send. Accept describes what you want back (and the right value is application/json, not text/json).

In GET /users/42?active=true, what is 42 and what is active=true?

• 42 is a query parameter, active=true is a path parameter
• 42 is a path parameter, active=true is a query parameter
• Both are headers
• Both are path parameters

Answer: 42 is a path parameter, active=true is a query parameter. The path identifies the resource (user 42). Query parameters, after the question mark, filter or shape the result.

A POST request creates a new record successfully. Which status code is the most appropriate?

• 201 Created
• 204 No Content
• 302 Found
• 304 Not Modified

Answer: 201 Created. 201 means a new resource was created and normally comes with the new resource or a Location header. 200 is also seen, but 201 is the precise answer.

A client calls an endpoint with no token at all. The correct response is:

• 403 Forbidden
• 404 Not Found
• 401 Unauthorized
• 200 OK with an error message

Answer: 401 Unauthorized. 401 means the caller is not authenticated. 403 means the caller is known but not allowed. Returning 200 with an error body breaks the contract clients depend on.

A normal user with a valid token calls an admin-only endpoint. Which status code should be returned?

• 401 Unauthorized
• 400 Bad Request
• 404 Not Found
• 403 Forbidden

Answer: 403 Forbidden. The identity is known, but the permission is missing, which is 403. Some APIs deliberately return 404 to hide that the resource exists, but 403 is the standard answer.

Registering with an email address that already exists should return:

• 500 Internal Server Error
• 409 Conflict
• 204 No Content
• 301 Moved Permanently

Answer: 409 Conflict. 409 signals a conflict with the current state of the resource. Some APIs use 422 for business-rule failures. A 500 here would be a bug.

You send malformed JSON and the API returns 500. What is the issue?

• The API should have returned a 4xx such as 400, because the client sent bad input
• Nothing, 500 is the correct code for any error
• The test is wrong, because JSON is never malformed
• The API should have returned 200

Answer: The API should have returned a 4xx such as 400, because the client sent bad input. 5xx means the server failed. Bad input from the client is a 4xx. A 500 for invalid input is a defect worth reporting, and often means the input was not validated.

A client sends too many requests in a minute and exceeds the rate limit. Which code is returned?

• 408 Request Timeout
• 503 Service Unavailable
• 401 Unauthorized
• 429 Too Many Requests

Answer: 429 Too Many Requests. 429 is the standard rate-limit response and is often accompanied by a Retry-After header.

HTTP Basic authentication sends credentials as:

• An encrypted token that cannot be read
• A hash of the password only
• username:password encoded in Base64, which is encoding and not encryption
• A cookie set by the browser only

Answer: username:password encoded in Base64, which is encoding and not encryption. Base64 is reversible by anyone, so Basic auth is safe only over HTTPS. Never treat Base64 as protection.

How is a Bearer token normally sent?

• In the URL path
• In the Authorization header as: Bearer <token>
• In the request body only
• In the User-Agent header

Answer: In the Authorization header as: Bearer <token>. The convention is Authorization: Bearer followed by the token. Tokens in URLs leak into logs and browser history.

Which statement about the payload of a JWT is true?

• Anyone who has the token can read the payload, because it is only Base64URL-encoded
• The payload is encrypted with the server's key
• The payload can never be changed by the client
• The payload is deleted after the first use

Answer: Anyone who has the token can read the payload, because it is only Base64URL-encoded. A signed JWT cannot be altered without detection, but its contents are readable. Never put passwords or other secrets in the payload.

User A, logged in, changes the order id in /orders/101 to 102 and sees user B's order. This is a failure of:

• Pagination
• Rate limiting
• Content negotiation
• Authorization (object-level access control)

Answer: Authorization (object-level access control). The user is authenticated, but the server did not check that the order belongs to them. Testing this by swapping ids with another user's data is a core API security check.

Which is the weakest assertion for a successful GET /users/42?

• Status is 200 and the id field equals 42
• Status is 200 and nothing else
• Status is 200, id equals 42 and password is not in the body
• Status is 200 and response time is under the agreed limit

Answer: Status is 200 and nothing else. A status code alone proves little: the body could be empty or wrong. Good tests check the body, the headers and sensitive fields that must be absent.

In a Postman test script, which line reads the JSON body of the response?

• pm.response.body()
• pm.request.json()
• pm.response.json()
• postman.json()

Answer: pm.response.json(). pm.response.json() parses the response body. pm.request refers to the request that was sent.

What is the purpose of a Postman environment variable such as {{baseUrl}}?

• To run the same requests against different servers (dev, test, staging) by changing one value
• To encrypt the request
• To speed up the server
• To cache the response

Answer: To run the same requests against different servers (dev, test, staging) by changing one value. Variables let one collection target several environments, and keep tokens and URLs out of individual requests.

Which Rest Assured structure is the standard way to write a request and check the result?

• start / run / stop
• arrange / assert
• open / read / close
• given() / when() / then()

Answer: given() / when() / then(). given() sets up the request (headers, body), when() sends it (get, post), and then() checks the response (status, body, time).

You test a paginated list endpoint. Which check finds a classic pagination bug?

• Checking that page 1 has the right title
• Verifying that no item appears on two pages and none is skipped between them
• Checking the response is under one megabyte
• Calling the endpoint once

Answer: Verifying that no item appears on two pages and none is skipped between them. Off-by-one and unstable sort order cause duplicates or missing items at page boundaries. Compare the full set across pages, and check page size and out-of-range pages too.

A payment endpoint accepts an Idempotency-Key header. What is it for?

• To authenticate the user
• To compress the response
• To make sure a retried request does not create a second payment
• To pick the currency

Answer: To make sure a retried request does not create a second payment. The server stores the result for the key. If the same request is retried after a timeout or double click, it returns the stored result instead of charging again.