API Testing Interview Questions for Freshers (2026): 60+ Questions with Answers on REST, Postman, Status Codes, REST Assured and Real Scenarios

What are the most asked API testing interview questions for freshers? Interviewers usually ask what an API is, how REST works, the HTTP methods and status codes, how you test an API in Postman, what test cases you would write for a login or create-user API, how to validate the response, how authentication works, and, for automation roles, a basic REST Assured example. If you can explain these with a small request and response, you’re well prepared.

This guide from VibrantMinds Technologies in Pune covers 60+ API testing interview questions and answers, with Postman test scripts, a REST Assured example, an API test case template, a bug report template, real scenario questions, mistakes to avoid and a 14-day plan. If you’ve been searching for API testing interview questions for freshers, Postman interview questions for freshers, REST API testing interview questions, REST Assured interview questions, HTTP status codes interview questions, API test cases examples, API automation testing for freshers or free IT job WhatsApp groups for freshers in Pune, this is built to be the complete answer.

Tools and features change. This guide focuses on stable fundamentals. Check each tool’s current documentation and ask which tools a company uses. It avoids salary figures and unverified statistics.

HOW API TESTING INTERVIEWS USUALLY FLOW

THE BIG PICTURE: REQUEST AND RESPONSE

A sample request and response to keep in mind:

MODULE 1: API BASICS (Q1 TO Q10)

Q1. What is an API?
Answer: An Application Programming Interface is a set of rules that lets one software system talk to another. For example, a mobile app calls an API to fetch data from a server.

Q2. What is API testing?
Answer: Testing an API directly, without a user interface, by sending requests and verifying the responses, data, status codes, performance and security against the expected behaviour.

Q3. Why is API testing important?
Answer: It finds problems early, is usually faster and more stable than UI testing, tests business logic directly, and supports automation and continuous integration.

Q4. API testing vs UI testing?

Both are needed, and they complement each other.

Q5. What is the test pyramid and where does API testing fit?
Answer: The pyramid suggests many unit tests at the base, a moderate number of API/service tests in the middle and fewer UI tests at the top. API tests sit in the middle layer.

Q6. What is an endpoint?
Answer: A specific URL where an API receives requests, for example https://api.example.com/users/5.

Q7. What are the parts of an API request?
Answer: Method (GET, POST...), URL (endpoint, path and query parameters), headers, body (for methods like POST and PUT) and optional authentication.

Q8. What are path parameters vs query parameters?
Answer: Path parameters are part of the URL path (/users/5). Query parameters come after ? and filter or modify the request (/users?role=admin&page=2).

Q9. What are the types of APIs?
Answer: REST, SOAP, GraphQL and others. REST is the most commonly tested in fresher roles.

Q10. REST vs SOAP?

MODULE 2: HTTP METHODS, STATUS CODES AND HEADERS (Q11 TO Q22)

Q11. Explain the main HTTP methods.

Q12. What does idempotent mean?
Answer: Making the same request multiple times has the same effect as making it once. For example, deleting the same resource twice leaves the system in the same state.

Q13. Difference between PUT and PATCH?
Answer: PUT replaces the whole resource (you send the full object). PATCH updates only specified fields.

Q14. Difference between PUT and POST?
Answer: POST usually creates a new resource and the server decides the ID, and repeating it can create duplicates. PUT updates or creates at a known URL, and repeating it gives the same result.

Q15. HTTP status code groups

Q16. Status codes you must know

Q17. 401 vs 403?
Answer: 401 means the client isn’t authenticated (no or invalid credentials). 403 means the client is authenticated but doesn’t have permission.

Q18. 400 vs 404 vs 422?
Answer: 400 is a malformed or invalid request. 404 means the resource doesn’t exist. 422 (used by some APIs) means the request is well-formed but fails validation rules. Teams differ on 400 vs 422, so follow the API’s documentation.

Q19. What are headers? Name important ones.
Answer: Headers carry metadata about the request or response. Common ones: Content-Type, Accept, Authorization, Cache-Control, User-Agent, Content-Length, Set-Cookie.

Q20. Content-Type vs Accept?
Answer: Content-Type describes the format of the data you’re sending. Accept states the format you want to receive.

Q21. What are cookies and sessions in the API context?
Answer: Cookies store small pieces of data in the client, often used to maintain sessions. APIs may also be stateless, with each request carrying its own credentials, such as tokens.

Q22. What does “stateless” mean in REST?
Answer: Each request contains all the information the server needs. The server doesn’t store client session state between requests.

MODULE 3: REST PRINCIPLES AND JSON (Q23 TO Q30)

Q23. What are the key REST principles?
Answer: Client-server separation, statelessness, cacheability, a uniform interface (consistent URLs and methods), layered system and resources identified by URLs.

Q24. What are good REST URL conventions?
Answer: Use nouns, not verbs: /users, /users/5, /users/5/orders. Use HTTP methods to express actions instead of URLs like /getUser.

Q25. What is JSON? Give an example.

json

{
  "id": 101,
  "name": "Amit",
  "skills": ["Java", "SQL"],
  "address": { "city": "Pune", "pin": "411052" },
  "active": true
}

{
  "id": 101,
  "name": "Amit",
  "skills": ["Java", "SQL"],
  "address": { "city": "Pune", "pin": "411052" },
  "active": true
}

{
  "id": 101,
  "name": "Amit",
  "skills": ["Java", "SQL"],
  "address": { "city": "Pune", "pin": "411052" },
  "active": true
}

JSON stores data as key-value pairs, arrays and nested objects.

Q26. JSON vs XML?
Answer: JSON is lighter and easier to read and parse in most modern applications. XML is more verbose but supports features such as attributes, schemas and namespaces, and is used in some systems like SOAP.

Q27. How do you validate a JSON response?
Answer: Check the status code, required fields, data types, values, array sizes, nested objects, and the response schema if one is available. Also check headers and response time.

Q28. What is JSON schema validation?
Answer: Verifying that a response matches a defined structure (fields, types, required properties), which catches unexpected changes.

Q29. What is pagination and how do you test it?
Answer: Returning large lists in pages (for example ?page=2&size=10). Test first page, last page, page beyond the last, page size limits, invalid values and total count consistency.

Q30. What are Swagger and OpenAPI?
Answer: OpenAPI is a standard for describing REST APIs. Swagger tools can show interactive documentation and let you try endpoints. Testers use these documents to understand endpoints and expected behaviour.

MODULE 4: AUTHENTICATION AND SECURITY TESTING (Q31 TO Q36)

Q31. Authentication vs authorisation?
Answer: Authentication verifies who you are. Authorisation decides what you’re allowed to do.

Q32. Common API authentication methods

Q33. What is a JWT?
Answer: A JSON Web Token has three parts (header, payload, signature). The server issues it after login. The client sends it with later requests, and the server verifies it. The payload is encoded, not encrypted, so it shouldn’t hold secrets.

Q34. How do you test an API that needs a token in Postman?
Answer: Call the login endpoint, save the token in an environment variable using a test script, and use {{token}} in the Authorization header of later requests.

Q35. What security tests can a fresher do on an API?
Answer: Missing or invalid token (expect 401), accessing another user’s data (expect 403 or 404), SQL injection strings in inputs, very long inputs, special characters, missing required fields, wrong content types, and checking that sensitive data isn’t exposed in responses.

Q36. Why must APIs use HTTPS?
Answer: HTTPS encrypts data in transit, protecting credentials and personal data from being read on the network.

MODULE 5: POSTMAN (Q37 TO Q48)

Q37. What is Postman and why is it used?
Answer: A tool for building, sending and testing API requests, organising them into collections, writing test scripts and sharing them with a team.

Q38. What are collections and folders?
Answer: A collection groups related requests. Folders organise requests inside a collection, for example by feature.

Q39. What are environments and variables?
Answer: Variables hold values you reuse, such as a base URL or token. Environments (for example Dev, QA, Staging) store sets of variable values so the same collection can run against different servers.

Use a variable in a request like this: {{baseUrl}}/users.

Q40. How do you write tests in Postman?
Answer: In the Tests tab, using JavaScript with the pm object.

javascript

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("Response time is acceptable", function () {
    pm.expect(pm.response.responseTime).to.be.below(1000);
});

pm.test("Response has the correct name", function () {
    const json = pm.response.json();
    pm.expect(json.name).to.eql("Amit");
});

pm.test("Content-Type is JSON", function () {
    pm.response.to.have.header("Content-Type");
});

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("Response time is acceptable", function () {
    pm.expect(pm.response.responseTime).to.be.below(1000);
});

pm.test("Response has the correct name", function () {
    const json = pm.response.json();
    pm.expect(json.name).to.eql("Amit");
});

pm.test("Content-Type is JSON", function () {
    pm.response.to.have.header("Content-Type");
});

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("Response time is acceptable", function () {
    pm.expect(pm.response.responseTime).to.be.below(1000);
});

pm.test("Response has the correct name", function () {
    const json = pm.response.json();
    pm.expect(json.name).to.eql("Amit");
});

pm.test("Content-Type is JSON", function () {
    pm.response.to.have.header("Content-Type");
});

Q41. How do you save a token from a login response?

javascript

const json = pm.response.json();
pm.environment.set("token", json.token);

const json = pm.response.json();
pm.environment.set("token", json.token);

const json = pm.response.json();
pm.environment.set("token", json.token);

Then use Bearer {{token}} in the Authorization header of later requests.

Q42. What is a pre-request script?
Answer: JavaScript that runs before the request is sent, used for tasks such as generating a timestamp, creating random test data or setting variables.

javascript

pm.variables.set("randomEmail", "user" + Date.now() + "@example.com");

pm.variables.set("randomEmail", "user" + Date.now() + "@example.com");

pm.variables.set("randomEmail", "user" + Date.now() + "@example.com");

Q43. How do you chain requests?
Answer: Extract data from one response (for example an ID or token), store it in a variable and use it in the next request.

Q44. What is the Collection Runner?
Answer: A feature that runs all requests in a collection (or folder) in order, optionally with iterations and data files, and shows pass or fail results.

Q45. How do you do data-driven testing in Postman?
Answer: Use a CSV or JSON data file in the Collection Runner. Each row becomes an iteration, and you reference values with {{columnName}}.

Q46. What is Newman?
Answer: Postman’s command-line runner for collections. It lets you run collections in a terminal or CI pipeline.

bash

newman run my-collection.json -e

newman run my-collection.json -e

newman run my-collection.json -e

Q47. What are mock servers and why use them?
Answer: A mock server simulates an API’s responses so front-end or testing work can continue before the real API is ready. Check your Postman version for how this feature is offered.

Q48. Postman vs Swagger UI vs cURL?
Answer: Postman gives a full workspace with collections, tests and automation. Swagger UI lets you try endpoints from documentation. cURL is a command-line tool for sending requests quickly.

bash

curl -X GET "https://api.example.com/users/1" -H "Accept: application/json"

curl -X GET "https://api.example.com/users/1" -H "Accept: application/json"

curl -X GET "https://api.example.com/users/1" -H "Accept: application/json"

MODULE 6: REST ASSURED AND API AUTOMATION (Q49 TO Q55)

Mention these only if you’ve practised them. Many fresher interviews stop at Postman.

Q49. What is REST Assured?
Answer: A Java library for testing REST APIs with readable, fluent syntax, commonly used with TestNG or JUnit.

Q50. Show a basic REST Assured GET test.

java

import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;

@Test
public void getUserTest() {
    given()
        .baseUri("https://api.example.com")
        .header("Accept", "application/json")
    .when()
        .get("/users/1")
    .then()
        .statusCode(200)
        .body("name", equalTo("Amit"))
        .body("skills", hasItem("Java"));
}

import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;

@Test
public void getUserTest() {
    given()
        .baseUri("https://api.example.com")
        .header("Accept", "application/json")
    .when()
        .get("/users/1")
    .then()
        .statusCode(200)
        .body("name", equalTo("Amit"))
        .body("skills", hasItem("Java"));
}

import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;

@Test
public void getUserTest() {
    given()
        .baseUri("https://api.example.com")
        .header("Accept", "application/json")
    .when()
        .get("/users/1")
    .then()
        .statusCode(200)
        .body("name", equalTo("Amit"))
        .body("skills", hasItem("Java"));
}

Q51. Show a POST example with a JSON body.

java

@Test
public void createUserTest() {
    String body = "{ \"name\": \"Amit\", \"email\": \"amit@example.com\" }";

    given()
        .baseUri("https://api.example.com")
        .header("Content-Type", "application/json")
        .body(body)
    .when()
        .post("/users")
    .then()
        .statusCode(201)
        .body("id", notNullValue());
}

@Test
public void createUserTest() {
    String body = "{ \"name\": \"Amit\", \"email\": \"amit@example.com\" }";

    given()
        .baseUri("https://api.example.com")
        .header("Content-Type", "application/json")
        .body(body)
    .when()
        .post("/users")
    .then()
        .statusCode(201)
        .body("id", notNullValue());
}

@Test
public void createUserTest() {
    String body = "{ \"name\": \"Amit\", \"email\": \"amit@example.com\" }";

    given()
        .baseUri("https://api.example.com")
        .header("Content-Type", "application/json")
        .body(body)
    .when()
        .post("/users")
    .then()
        .statusCode(201)
        .body("id", notNullValue());
}

Q52. What do given(), when() and then() mean?
Answer: given() sets up the request (headers, body, parameters). when() performs the request. then() validates the response.

Q53. How do you extract a value from a response?

java

int id = given()
            .baseUri("https://api.example.com")
        .when()
            .get("/users/1")
        .then()
            .extract()
            .path("id");

int id = given()
            .baseUri("https://api.example.com")
        .when()
            .get("/users/1")
        .then()
            .extract()
            .path("id");

int id = given()
            .baseUri("https://api.example.com")
        .when()
            .get("/users/1")
        .then()
            .extract()
            .path("id");

Q54. How do you handle authentication in REST Assured?
Answer: Add the header, for example .header("Authorization", "Bearer " + token), or use built-in authentication helpers such as basic auth.

Q55. What is a simple API automation framework structure?

MODULE 7: TEST DESIGN, TEST CASES AND BUG REPORTS (Q56 TO Q62)

Q56. What do you verify in an API response?

Q57. What types of test cases do you write for an API?
Answer: Positive (valid input), negative (invalid input, missing fields, wrong types), boundary (minimum and maximum lengths and values), security (missing or invalid token, access control), performance (basic response time) and error handling (500s should be avoided and messages should be clear).

Q58. How would you test a login API?

Q59. How would you test a create-user API (POST)?

Q60. How do you test a search or filter API?
Answer: Valid keywords, partial matches, case sensitivity, no results (empty list with 200), special characters, multiple filters, sorting, pagination limits and performance with large result sets.

Q61. What do you include in an API bug report?

Q62. What is the difference between a 4xx and 5xx bug?
Answer: A 4xx response is a client-side error, which is often the expected reply to invalid input. A 5xx means the server failed, and when it occurs for invalid or unexpected input it usually indicates a bug in error handling.

API TEST CASE TEMPLATE (COPY AND ADAPT)

SCENARIO QUESTIONS

COMMON MISTAKES FRESHERS MAKE IN API TESTING INTERVIEWS

14-DAY API TESTING PREPARATION PLAN

MYTH VS REALITY

HOW VIBRANTMINDS HELPS FRESHERS BECOME JOB-READY IN SOFTWARE TESTING

VibrantMinds Technologies Pvt. Ltd. is a Pune-based IT training and placement support company. If you searched for VibrantMinds or VibrantMinds Technologies, here is what it offers:

• Software Testing (Manual + Automation) (about 2 to 5 months): Test cases, STLC, bug tracking, SQL and Selenium basics. Please check the candidate portal for the latest syllabus, including which API testing tools are covered.

• Full Stack Java Development (about 4 to 6 months) and Core Java (about 1 to 2 months), which help with Java-based automation

• Python & Data Science for other career paths

• Practice projects: Test real-style applications, write test cases and log defects

• Interview preparation: Technical rounds, HR rounds, aptitude, communication and mock interviews

• Resume and LinkedIn guidance: Clear, honest profiles

• Placement support: Screening, drive coordination and interview support. Check the campus-drives portal at https://candidates.vibrantminds.in/ for current openings.

• Free WhatsApp job alert groups for fresher IT jobs and drives

• Honesty first: VibrantMinds offers placement support, not a guaranteed job, and no legitimate recruiter should ask you to pay to be interviewed.

VibrantMinds works as a talent ecosystem connecting candidates, colleges and companies, with 1900+ partner colleges and 600+ hiring companies. Read more fresher job guidance here: https://candidates.vibrantminds.in/blog/fresher-jobs-pune-2026

VIBRANTMINDS COURSES AT A GLANCE

Fees, syllabus and batch dates are on https://candidates.vibrantminds.in/. Please confirm them directly before enrolling.

THE VIBRANTMINDS PLACEMENT PIPELINE: SIX STEPS

REAL OUTCOMES: WHAT TO EXPECT AND WHAT NOT TO

Past students have shared positive feedback about the training and support, and have gone on to roles at companies such as Aress Software and Education Technologies, Saama Technologies and Three M Software. Results vary by candidate, skill level, effort and market conditions, so please confirm details directly with the VibrantMinds team. No one can honestly promise a guaranteed job.

JOIN FREE VIBRANTMINDS WHATSAPP GROUPS: FRESHER IT JOB UPDATES FOR PUNE AND INDIA

Looking for free WhatsApp groups for IT jobs, a Java WhatsApp group for freshers or a job updates WhatsApp group in India? The VibrantMinds groups share fresher IT openings, campus drives, walk-in interview alerts and interview preparation updates, free of charge. Join whichever group has space. All three carry the same type of updates.

Never pay to apply. Legitimate recruiters do not charge candidates for tests, interviews or offer letters. Do not share sensitive personal or financial details in any group chat.

FREQUENTLY ASKED QUESTIONS

1. What are the most asked API testing interview questions for freshers?
What an API and REST are, HTTP methods, status codes (especially 200, 201, 400, 401, 403, 404, 500), headers, JSON validation, authentication methods, how to use Postman (collections, environments, tests), how to test a login or create-user API, and a basic REST Assured example for automation roles.

2. What is the difference between PUT and PATCH in API testing?
PUT replaces the entire resource, so you send the full object. PATCH updates only the fields you send. PUT is idempotent, while PATCH is not guaranteed to be, depending on the implementation.

3. How do I write test scripts in Postman as a fresher?
Open the Tests tab of a request and use JavaScript with the pm object, for example pm.test("Status is 200", () => pm.response.to.have.status(200)). You can also check the response body with pm.response.json() and save values like tokens with pm.environment.set.

4. How do I test a login API?
Test valid credentials (200 and a token), wrong password (401), unknown user, empty fields (400), invalid email format, injection strings, very long inputs, wrong content type, repeated failed attempts and how the token works on a protected API.

5. Are there free WhatsApp groups for IT fresher jobs in Pune?
Yes. VibrantMinds runs free fresher IT job WhatsApp groups that share openings, campus drives and walk-in alerts. Join through the links above. Always verify any job post and never pay to apply.

CONCLUSION: UNDERSTAND THE REQUEST, VERIFY THE RESPONSE, THINK BEYOND THE HAPPY PATH

The best preparation for API testing interview questions for freshers is hands-on practice. Learn HTTP methods and status codes properly, build and run a Postman collection with tests and variables, write positive, negative, boundary and security test cases, practise a login and a create-user scenario, and try a small REST Assured example if you’re aiming at automation roles. Follow the 14-day plan, practise aloud and stay honest about what you’ve done.

If you’re in Pune and want structured software testing or Java training with practice projects, interview preparation and placement support, VibrantMinds Technologies is here to help.

Call to action:

• Website: https://vibrantminds.in/

• Candidate portal and courses: https://candidates.vibrantminds.in/

• Fresher jobs guide: https://candidates.vibrantminds.in/blog/fresher-jobs-pune-2026

• Join the free WhatsApp groups: the three links above

VISIT OR CONTACT VIBRANTMINDS IN PUNE

• Company: VibrantMinds Technologies Pvt. Ltd.

• Address: Viva Academy Building, Warje, Pune, Maharashtra 411052

• Phone: +91 95035 79517

• Email: support@vibrantmindstech.com

• Website: https://vibrantminds.in/

• Candidate portal and courses: https://candidates.vibrantminds.in/