API Developer mock interview questions
19 questions a API Developer panel actually asks, with what each one tests and what a strong answer contains, then practice any of them live. HTTP semantics and API design round for API developer interviews.
Answer one real API Developer question now
A question a API Developer panel actually asks, answered out loud, scored on what you said and how you said it. Under two minutes, and nothing to sign up for.
“Design the API for creating payments that a mobile client can retry safely on a flaky network. What stops a customer being charged twice?”
We never store the audio. Your answer is deleted within 24 hours unless you save the result.
- Adaptive follow-ups, not a fixed question list
- Rubric scorecard with evidence from your answers
- Voice or text, with delivery coaching on voice sessions
Thinking past the interview? Carmen can help with your whole API Developer career: a switch, a raise, or what comes next.
19 api developer mock interview questions
The questions a API Developer panel actually asks, with what each one is testing and what a strong answer contains. Click any question to run it in a live session: your AI interviewer will cover it and score how you answer.
- 1.
Design the API for creating payments that a mobile client can retry safely on a flaky network. What stops a customer being charged twice?
Why they ask it: Idempotency is the core API design concept that separates careful developers from fast ones. The interviewer is waiting for idempotency keys and what the server does with them.
A strong answer: A POST that requires a client-generated idempotency key, the server storing the key with the request fingerprint and the resulting response, returning the stored response on a repeat, rejecting the same key with a different body, handling a repeat that arrives while the first is still in flight, and an expiry policy for stored keys. Mentioning that PUT and DELETE are idempotent by definition but POST is not is the grounding detail.
- 2.
When do you return 400, 401, 403, 404, 409 and 422, and what goes in the error body?
Why they ask it: Tests HTTP fluency and empathy for the consumer. Inconsistent status codes are one of the most common complaints about APIs.
A strong answer: 400 for malformed requests, 401 when authentication is missing or invalid, 403 when the caller is known but not allowed, 404 for a missing resource (and sometimes to avoid revealing existence), 409 for a state conflict such as a version mismatch, 422 for well-formed input that fails validation. The body should be a consistent machine-readable structure with an error code, a human message and field-level details, such as the problem details format.
- 3.
You need to change a field in a public API that many external clients use. How do you evolve it without breaking them?
Why they ask it: Versioning and deprecation are where APIs meet real users. Tests whether you know what counts as a breaking change.
A strong answer: Additive changes are safe if clients ignore unknown fields; renaming, removing or changing a type is breaking. Add the new field alongside the old, document the deprecation with a timeline, signal it with headers and changelogs, measure who still calls the old shape, contact heavy users directly, and only then remove it or introduce a new version. Stating a versioning scheme and why is better than arguing that one scheme is correct.
- 4.
A list endpoint that used offset pagination is timing out and customers report missing and duplicated items between pages. What is going on and what do you change?
Why they ask it: A debugging scenario that tests knowledge of how pagination behaves on large, changing datasets.
A strong answer: Large offsets force the database to scan and discard rows, and inserts or deletes between requests shift the window so items are skipped or repeated. Move to cursor or keyset pagination on a stable, indexed sort key with a tiebreaker, return an opaque cursor, keep the old parameters working during a transition, and check the query plan to confirm the index is used.
- 5.
How would you secure an API used both by your own web app and by third-party integrations?
Why they ask it: Authentication and authorisation design, with two quite different client types.
A strong answer: Session or token auth for the first-party app, OAuth 2.0 with scoped access tokens for third parties, short-lived tokens with refresh, authorisation checks on every object access to prevent one tenant reading another's data, rate limiting per client, TLS everywhere, and audit logging for sensitive operations. Naming broken object-level authorisation as the most common real API flaw is a strong signal.
- 6.
REST, GraphQL or gRPC for a new internal service that several teams will call. How do you decide?
Why they ask it: A tradeoff question. There is no correct answer, only reasoning that fits the context.
A strong answer: gRPC for internal service-to-service calls where typed contracts, streaming and performance matter and both sides are controlled. GraphQL where many clients need different shapes of related data and a team will own the schema and its query cost controls. REST where broad compatibility, caching and simplicity matter. A strong answer asks about the callers first and names the operational costs of each.
- 7.
Tell me about a time an API you owned broke a consumer. How did you find out, and what changed afterwards?
Why they ask it: Behavioural, aimed at the real pressure of API work: the people you break often do not work for you.
A strong answer: What changed and why it was not recognised as breaking, how the break surfaced, the rollback or compatibility shim, how you communicated with the affected consumer, and the lasting fix such as contract tests, a schema diff check in CI, or a stricter deprecation policy.
How the API Developer interview runs
Usually a recruiter screen, a technical round on HTTP semantics and API design, and a practical exercise where you design or extend an API, either live or as a short take-home that ships with an OpenAPI description. Later rounds tend to cover versioning, authentication, and how you have handled consumers you do not control. Many teams include a review of an existing API with deliberate flaws for you to find.
What the panel scores
HTTP and contract design
Whether the API behaves predictably under the rules of the protocol.
- Uses methods and status codes precisely
- Designs for idempotency and retries
- Consistent, machine-readable errors
Evolution and compatibility
Whether the API can change without harming its consumers.
- Knows which changes are breaking
- Has a deprecation and communication plan
- Uses contract tests or schema diffs
Security
Whether every request is authenticated and authorised correctly.
- Checks object-level authorisation
- Chooses auth schemes by client type
- Applies rate limits and audit logging
Consumer empathy
Whether the API is pleasant and safe to integrate with.
- Writes clear documentation and examples
- Thinks from the caller's retry and error handling
- Designs pagination and filtering for real usage
Common questions in every interview
These come up in almost every API Developer interview regardless of the company or the round.
- 8.
Tell me about yourself.
Why they ask it: Opens the interview and sets the frame. The interviewer is checking whether you can select what matters for this job rather than narrate your whole history.
A strong answer: A 60-90 second arc: where you are now, one or two proof points that match the posting, and why this role is the logical next step. Present, past, then future.
- 9.
Why do you want this role?
Why they ask it: Tests whether you read the job description or mass-applied. Weak answers are about what the candidate gets; strong answers connect to the work itself.
A strong answer: Two specifics from the posting or the company's actual work, plus an honest line about what you want to get better at here.
- 10.
Walk me through your resume.
Why they ask it: Checks that your story holds together and that the transitions were deliberate rather than accidental.
A strong answer: Chronological but fast, with a reason attached to each move and more time on the roles closest to this one.
- 11.
Tell me about a time you failed.
Why they ask it: Tests self-awareness and whether you own outcomes. Interviewers are listening for a real failure, not a disguised strength.
A strong answer: A genuine miss, what you specifically got wrong, the cost, and the concrete thing you changed afterwards that has since held up.
- 12.
Tell me about a conflict with a coworker or manager.
Why they ask it: Predicts how you behave when the team disagrees. The trap is blaming the other person.
A strong answer: The substance of the disagreement, what you did to understand their position, how it resolved, and what the working relationship looked like after.
- 13.
What's your greatest strength?
Why they ask it: Checks whether you know what you're actually good at and can prove it.
A strong answer: One strength that maps to the posting, plus a short example where it produced a measurable result.
- 14.
What's your greatest weakness?
Why they ask it: Tests honesty and whether you're actively working on something. Rehearsed non-answers ('I work too hard') read as evasive.
A strong answer: A real limitation that isn't core to the job, the system you built to manage it, and evidence it's improving.
- 15.
Tell me about a time you had to influence someone without authority.
Why they ask it: Almost every role depends on getting people who don't report to you to change course.
A strong answer: What you wanted, why they resisted, the evidence or framing that moved them, and what actually shipped as a result.
- 16.
Where do you see yourself in five years?
Why they ask it: Tests whether this job fits your trajectory, which is a retention question in disguise.
A strong answer: A direction rather than a title, and a line about the skills this role would build toward it. Vague ambition and rigid title-chasing both land badly.
- 17.
Why are you leaving your current job?
Why they ask it: Screens for red flags. Interviewers listen for how you talk about people you no longer work with.
A strong answer: Forward-looking and specific about what you're moving toward. Criticism of a former employer costs you more than it gains, even when it's deserved.
- 18.
What are your salary expectations?
Why they ask it: Checks whether you've done market research and whether you're in range before anyone spends more time.
A strong answer: A researched range with your target near the bottom of it, framed against the scope of the role. Deflect once if the posting has no band, then answer.
- 19.
Do you have any questions for us?
Why they ask it: The most under-prepared question in the interview, and the one that most changes the final impression.
A strong answer: Two or three questions about how the team actually works: what the first 90 days look like, how success is measured, what the hardest part of the job is.
Every round ends in a scorecard like this
Your API Developer answers, quoted back, scored on what this role is judged on, with the line to say instead.
Real screen from the app. Sample from a product design round.
Related roles
All Engineering →No spam. Unsubscribe anytime.
Ready to practice as a API Developer?
Sign up free, no card. 30 voice minutes and unlimited typed interviews, each ending in the complete scorecard: rubric scores, strengths, and what to fix next. Nothing is blurred.
- ✓ Predefined role or paste any job description
- ✓ Rubric scores with evidence quotes
- ✓ 888+ roles to choose from
Questions & answers
- Is the API Developer mock interview free?
- Yes. 30 voice minutes and unlimited typed API Developer interviews, no card. You get the complete rubric scorecard every time, with the evidence quoted from your own answers. Nothing is blurred.
- Can I use my own job description instead?
- Yes. Predefined roles are starting points. Paste any JD in the setup form and your AI interviewer will tailor questions to that posting.
- How is scoring tailored to this role?
- We pre-fill a realistic API Developer job description and interview format so questions and the scorecard match how this role is actually interviewed.
- Should I tailor my resume before practicing?
- Run a resume fit check against a API Developer job description first, then practice the interview with the same JD for a tighter loop.