37 Backend & API interview questions with answers (2026)

All Backend & API interview questions

What is rate limiting and what algorithms are used?

What is an idempotency key and what retry problem does it solve?

Offset vs cursor pagination — what is the difference and when to pick cursor?

What do "safe" and "idempotent" mean in HTTP? Which methods are which?

How does PUT differ from PATCH? What is the difference between JSON Merge Patch and JSON Patch?

After creating a resource, which status do you return: 200, 201, 202, or 204? When do you need a Location header?

When client input is wrong, do you return 400, 422, or 409? Distinguish the three.

How do you design an API error contract? What fields does RFC 9457 (problem+json) define?

A user double-clicks Pay because the network is slow. How do you design the flow to avoid duplicate transactions?

Should API versioning live in the URL or a header? When must you cut a new version, and how do you deprecate the old one?

Which rate-limiting algorithm do you use, and which headers must the server return so the client knows how long to wait?

A list endpoint needs filtering, sorting, and field selection. How do you design the query parameters cleanly and safely?

A report-export endpoint takes 3 minutes and keeps timing out. How do you redesign it?

You need a bulk endpoint that updates 500 records. If 3 of them fail, what status code do you return?

For cursor pagination: what should the cursor contain, and what happens when rows are inserted or deleted while the client is paging?

Two users edit the same record and the second one overwrites the first. How do ETag and If-Match solve this?

How would you design a webhook delivery system for partners? How do you handle retries, signing, and replay protection?

When a call to another service times out, how should the client retry? How do you pick the timeout?

You must change a response schema without breaking old clients (a mobile app you cannot force-update). How do you do it, and how do you police breaking changes?

Why does writing to the DB and then publishing a message cause data inconsistency? (the dual write problem)

What does an idempotent consumer mean? How do you choose a dedup key?

How should a consumer retry on failure? Why exponential backoff and jitter?

What do you do when consumers are slower than producers for a sustained period?

Kafka, RabbitMQ, or Redis Streams — for a given problem, which do you choose and why?

How do you implement the transactional outbox in production — polling publisher or CDC?

In a saga, how do you compensate when a later step fails? And what if the compensation itself fails?

In a system that handles payments, what data type do you store money in? How do you deal with multiple currencies?

How would you design role-based access control (RBAC) for a system with admins, staff, and customers?

When calling a cross-origin API with `fetch` and `credentials: 'include'`, what must the server return?

Between two services, should you use REST, gRPC, or a message queue? What drives the choice?

What belongs in an API gateway, and what must never be put there?

What is a BFF (Backend for Frontend)? If you already have a gateway, why add one?

You must change an API response that four other services consume — how do you avoid breaking them?

If a project uses an ORM (Prisma/TypeORM/Hibernate), can it still be SQL-injected? Where are the gaps?

An image-convert feature shells out to ImageMagick with a user-supplied filename. What is the risk and how would you rewrite it?

The frontend already validates the form with Zod — does the backend need to validate again? How should server-side validation be done?

The `GET /users/:id` endpoint returns the raw ORM record. What is wrong with that, even if the UI never displays the extra fields?

All Backend & API interview questions

What is rate limiting and what algorithms are used?
What is an idempotency key and what retry problem does it solve?
Offset vs cursor pagination — what is the difference and when to pick cursor?
What do "safe" and "idempotent" mean in HTTP? Which methods are which?
How does PUT differ from PATCH? What is the difference between JSON Merge Patch and JSON Patch?
After creating a resource, which status do you return: 200, 201, 202, or 204? When do you need a Location header?
When client input is wrong, do you return 400, 422, or 409? Distinguish the three.
How do you design an API error contract? What fields does RFC 9457 (problem+json) define?
A user double-clicks Pay because the network is slow. How do you design the flow to avoid duplicate transactions?
Should API versioning live in the URL or a header? When must you cut a new version, and how do you deprecate the old one?
Which rate-limiting algorithm do you use, and which headers must the server return so the client knows how long to wait?
A list endpoint needs filtering, sorting, and field selection. How do you design the query parameters cleanly and safely?
A report-export endpoint takes 3 minutes and keeps timing out. How do you redesign it?
You need a bulk endpoint that updates 500 records. If 3 of them fail, what status code do you return?
For cursor pagination: what should the cursor contain, and what happens when rows are inserted or deleted while the client is paging?
Two users edit the same record and the second one overwrites the first. How do ETag and If-Match solve this?
How would you design a webhook delivery system for partners? How do you handle retries, signing, and replay protection?
When a call to another service times out, how should the client retry? How do you pick the timeout?
You must change a response schema without breaking old clients (a mobile app you cannot force-update). How do you do it, and how do you police breaking changes?
Why does writing to the DB and then publishing a message cause data inconsistency? (the dual write problem)
What does an idempotent consumer mean? How do you choose a dedup key?
How should a consumer retry on failure? Why exponential backoff and jitter?
What do you do when consumers are slower than producers for a sustained period?
Kafka, RabbitMQ, or Redis Streams — for a given problem, which do you choose and why?
How do you implement the transactional outbox in production — polling publisher or CDC?
In a saga, how do you compensate when a later step fails? And what if the compensation itself fails?
In a system that handles payments, what data type do you store money in? How do you deal with multiple currencies?
How would you design role-based access control (RBAC) for a system with admins, staff, and customers?
When calling a cross-origin API with `fetch` and `credentials: 'include'`, what must the server return?
Between two services, should you use REST, gRPC, or a message queue? What drives the choice?
What belongs in an API gateway, and what must never be put there?
What is a BFF (Backend for Frontend)? If you already have a gateway, why add one?
You must change an API response that four other services consume — how do you avoid breaking them?
If a project uses an ORM (Prisma/TypeORM/Hibernate), can it still be SQL-injected? Where are the gaps?
An image-convert feature shells out to ImageMagick with a user-supplied filename. What is the risk and how would you rewrite it?
The frontend already validates the form with Zod — does the backend need to validate again? How should server-side validation be done?
The `GET /users/:id` endpoint returns the raw ORM record. What is wrong with that, even if the UI never displays the extra fields?