Question 1

What is the difference between HTTP status 401 and 403?

Accepted Answer

401 means not authenticated (who are you?); 403 means authenticated but not allowed (you can't do this). Remember: 401 Unauthorized = authentication problem. 403 Forbidden = authorization problem. 404 = not found. 5xx = server bug.

Question 2

A POST /users request with valid data should typically return which status?

Accepted Answer

201 Created. Know the common success codes: 200 OK (general), 201 Created (POST created something), 204 No Content (success, empty body).

Question 3

A test checks only that GET /contacts returns status 200. What important checks are missing?

Accepted Answer

Assertions on the response body, shape, key fields and values. A complete API assertion covers: status code + response body (+ headers when relevant, e.g. content-type).

Question 4

What is the difference between PUT and PATCH?

Accepted Answer

PUT replaces the whole resource; PATCH updates only the provided fields. A strong PATCH test: change one field, then assert the other fields kept their old values. That is where replace-vs-merge bugs hide.

Question 5

Why are API tests generally more stable than UI tests?

Accepted Answer

No rendering, no selectors, no visual timing, just a request and a structured response. This is why the testing pyramid pushes coverage down: the API layer gives fast, deterministic feedback for business logic.

Question 6

How should an automated API test handle authentication tokens?

Accepted Answer

Obtain a fresh token in setup (login call) and send it in the Authorization header. Pattern: setup logs in → store token → send Authorization: Bearer <token> per request. Also test the negative case: no token → 401.

API Testing Interview Preparation

What is the difference between HTTP status 401 and 403?

Design the test list for an endpoint

Write the happy-path test