Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Short answer: A strong REST interview answer starts with resources and representations, then explains how HTTP methods, status codes, security controls, and an explicit contract work together. REST is not simply “JSON over HTTP.” Use the guide below to answer the questions interviewers commonly phrase as “What is REST?”, “What is the difference between PUT and PATCH?”, “What does stateless mean?”, and “How do you secure a REST API?” with precise, defensible reasoning.
What is REST?
REST (Representational State Transfer) is an architectural style organized around resources and a uniform interface. In the usual HTTP implementation, a URI identifies a target resource, the HTTP method supplies operation semantics, headers carry metadata, and a representation communicates information about the resource’s past, current, or desired state.
JSON is only one representation format. A service returning JSON from an endpoint is not automatically RESTful; it should also use HTTP semantics consistently, expose identifiable resources, remain stateless in the protocol sense, and provide a predictable interface. Avoid defining REST as “CRUD with plural nouns” because that misses the architectural constraints.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsResource versus representation
An order resource might be identified by /orders/42. The JSON document returned for that URI is a representation of the order at a particular time. The resource is not the response body itself, and the same resource can have JSON, XML, or another representation selected through content negotiation. HTTP does not limit what a resource can be.
How do HTTP methods work in REST?
| Method | Protocol meaning | Safety and retry implications |
|---|---|---|
| GET | Transfers a current representation of the target. | Safe and idempotent. “Safe” describes the requested action; logging or metrics may still occur. |
| POST | Asks the target resource to process the content according to resource-specific semantics. Creating a subordinate resource is common, but not the only use. | Not inherently safe or idempotent. Retrying can create duplicates unless the API defines an idempotency-key mechanism. |
| PUT | Requests that the target resource be created or replaced with the supplied representation, subject to the documented contract. | Idempotent by method definition; repeated identical requests have the same intended effect. |
| PATCH | Applies partial modifications described by the patch document. | Neither safe nor universally idempotent. Idempotency depends on the patch format and operation. |
| DELETE | Requests removal of the association between the target resource and its current functionality. | Idempotent in intended effect, although later responses can differ (for example, the second call may return 404). |
Only GET, HEAD, OPTIONS, and TRACE are defined as safe by HTTP semantics. Safe and idempotent are different properties: GET is both; POST is generally neither; a method can be idempotent without being safe.
PUT versus PATCH: what is the difference?
Use PUT for replacement
PUT /users/42 with a complete user representation tells the server to create or replace the state at that target, according to the API’s documented rules. A client can send the same request again after a timeout without intentionally applying the change twice. If omitted fields have meaning, document whether they are reset, defaulted, or rejected.
Use PATCH for a partial change
PATCH /users/42 might change only an email address or apply a JSON Patch operation. The server and client must agree on the patch media type and its semantics. A patch such as “increment balance” is not idempotent, while “set status to active” can be. Do not claim that PATCH is always idempotent.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to choose in an interview
- Explain whether the client possesses a complete representation or only a delta.
- Describe validation and conflict handling, including an entity version or conditional request where concurrent edits matter.
- Discuss retries: PUT is safe to retry by method semantics; POST needs an idempotency key or another deduplication design.
What does stateless mean in REST?
HTTP is stateless: each request’s semantics must be understandable in isolation, and the relationship between connections and messages must not change that interpretation. The server may store durable resource state such as accounts, orders, and documents. Statelessness does not mean “the database is empty” or “the server cannot remember anything.”
The distinction is between resource state and hidden conversational state needed to interpret the next request. Send the authentication context, resource identifier, and required parameters with each request rather than relying on an undocumented server-side session tied to a connection. OWASP specifically warns against passing session state through the backend as a purportedly stateless workaround.
Which HTTP status code should an API return?
Choose a code that describes the request’s outcome and processing state, not one generic success or failure code.
| Code | Use it when |
|---|---|
| 200 OK | The action succeeded and a response representation is returned where appropriate. |
| 201 Created | A resource was created. Return its URI in a Location header when applicable. |
| 202 Accepted | The request was accepted for asynchronous processing, but work is not complete. |
| 204 No Content | The request succeeded and there is no response body. |
| 400 Bad Request | The request is malformed or has a client-side request problem. |
| 401 Unauthorized | Credentials are absent, invalid, or otherwise insufficient to authenticate the caller. Despite its name, this is the authentication-related status. |
| 403 Forbidden | The server understood the caller and request but will not authorize that operation. |
| 404 Not Found | The target is not found, or the service deliberately hides its existence. |
| 405 Method Not Allowed | The method is known but unsupported for this target; advertise supported methods with Allow where required. |
| 409 Conflict | The request conflicts with current resource state, such as a version conflict. |
| 415 Unsupported Media Type | The request’s content format is not supported. |
| 422 Unprocessable Content | The syntax and content type are understood, but the instructions cannot be processed. |
| 429 Too Many Requests | The caller exceeded a rate limit or request-frequency policy. |
| 500 Internal Server Error | An unexpected server failure occurred. Never expose stack traces or secrets. |
401 versus 403
Return 401 when the service cannot establish a valid identity, such as a missing or expired bearer token. Return 403 when identity is known but the caller lacks permission for the requested operation or resource. Some services intentionally return 404 in either case to avoid revealing that a protected object exists; document that policy consistently.
What is idempotency and why does it matter?
An operation is idempotent when repeating an identical request has the same intended effect as making it once. It matters after a timeout: the client may not know whether the server completed the first attempt. PUT and DELETE are idempotent by definition. POST is not guaranteed to be, but an API can define an idempotency-key header for a particular workflow. That is an application feature, not a change to POST’s HTTP definition.
How do you secure a REST API?
- Use HTTPS everywhere. It protects credentials and message integrity in transit. Do not offer sensitive endpoints over plain HTTP.
- Authenticate the caller. Use an appropriate token, session, or client-credential mechanism and validate expiry, issuer, audience, and signature as applicable.
- Authorize every operation. Check both the requested action and the specific resource; authentication alone does not grant access.
- Validate input and content types. Enforce schemas, lengths, formats, request sizes, and supported media types. Reject unexpected methods with an allowlist.
- Rate-limit and monitor. Return 429 when policy limits are exceeded, log security events without logging credentials, and alert on abuse.
- Protect secrets. Do not put tokens or API keys in URLs, because URLs commonly enter browser, proxy, and server logs. API keys alone should not protect sensitive, critical, or high-value resources.
- Configure CORS narrowly. Permit only browser origins that need access. CORS controls browser behavior; it is not authentication.
NIST’s SP 800-228A, Guidelines for the Secure Deployment of RESTful Web APIs, was an initial public draft published May 18, 2026; its listed comment period closed July 2, 2026. Describe it as a draft unless a later final publication is verified.
What is OpenAPI?
OpenAPI is a language-agnostic description format for HTTP APIs. A contract can define paths, parameters, request and response schemas, authentication schemes, and error responses so that people and tools can understand the interface without reading implementation code or inspecting traffic. Documentation generators, client generators, and testing tools can consume it.
OpenAPI describes an API; it does not make an API RESTful. As of September 10, 2026, the OpenAPI Initiative identifies version 3.2.1 as the current published specification. Pin the version in your contract and review generated artifacts when the contract changes.
How should an API be versioned?
Start with the compatibility promise and migration plan, not with a favorite URL pattern. URL segments, headers, and media types can all be workable choices. Keep changes additive where possible, mark deprecated fields and operations, publish migration notes, and provide a transition window for breaking changes. There is no universal REST or HTTP requirement that selects one versioning strategy.
Rank #4
How do pagination, filtering, and sorting fit?
These are contract decisions. Document accepted filter names, sortable keys and direction, maximum page size, ordering guarantees, and what happens when records change during traversal. Page-number pagination is easy to understand for stable collections. Cursor pagination can provide more consistent traversal when a collection changes frequently, but cursors add client and server complexity. Neither is universally correct.
What makes a REST API usable?
A 2026 interview study by Sven Peldszus, Jan Rutenkolk, Marcel Heide, Jan Sollmann, Benjamin Klatt, Frank Köhne, and Thorsten Berger interviewed 16 REST API experts. It reported adherence to conventions as the most important usability factor among the factors studied, while guideline size and fit with organizational needs affected adoption. Treat this as a qualitative study finding, not a prevalence estimate. The practical lesson is to maintain concise, consistent guidance that teams can actually apply.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Practice scenario: explain a complete request
Suppose a client submits POST /orders with a validated JSON body. Authenticate the caller, authorize order creation, enforce the content type and schema, and apply a rate limit. If creation completes, return 201 and a Location header for /orders/42. If work is queued, return 202 and tell the client how to check status. If the same business action may be retried, accept an idempotency key and return the original result for duplicates. This explanation demonstrates semantics, status selection, security, and reliability together.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOr skip the browser setup
If an interview exercise or documentation task needs a rendered web page, ScreenshotNeo provides a single-call screenshot API. Cookie and consent banners, newsletter popups, and chat widgets are removed before capture. Bot checks, blank pages, failed loads, timeouts, and cache hits are not billed, and response headers identify the page verdict and billing result. Its MCP server lets Claude, Cursor, and other MCP clients use take_screenshot, get_page_info, and capture_pdf.
Use the documented options and parameter names at ScreenshotNeo’s API documentation. A basic cURL request is:
Best Value
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);There is a free allowance of 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
Common interview mistakes and fixes
- “REST means JSON.” Explain resources, representations, uniform HTTP semantics, and stateless requests instead.
- “PUT and PATCH are interchangeable.” Contrast replacement with partial modification and discuss retry behavior.
- “401 means not allowed.” Separate authentication failure (401) from authorization refusal (403).
- “Stateless means no server data.” Distinguish durable resource state from hidden conversational state.
- “Every success is 200.” Use 201, 202, or 204 when their conditions apply.
- “API keys secure everything.” Combine HTTPS, authorization, validation, method controls, and rate limiting.
- “OpenAPI makes an API RESTful.” Treat it as a contract and tooling format, not an architectural guarantee.
Frequently Asked Questions
Are REST interview questions ranked by employer frequency for 2026?
No. The available evidence supports representative prompts and technical answer guidance, not a dated, role- or region-specific ranking of employer questions.
Can a REST API use XML instead of JSON?
Yes. JSON is a common representation, but REST does not require a particular serialization format; the contract should define supported media types and content negotiation.
Should every DELETE request return 204?
No. Return the status that matches the documented outcome. A successful deletion may use 204, while a missing target, conflict, or asynchronous workflow can require a different response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
