API Design Interview Questions: REST, GraphQL, and Beyond
In almost every backend or full-stack interview, you'll be asked to design an API. Many candidates simply write out a few CRUD endpoints and stop. This guarantees a rejection. Senior engineers understand that API design is about contracts, backward compatibility, security, and scalability.
API Design Fundamentals
Before discussing specific protocols, understand that every API design decision involves trade-offs. The interviewer wants to see that you can articulate these trade-offs, not just pick the "right" answer.
The 5 Pillars of Production API Design
REST: When and Why
REST remains the dominant API paradigm for public-facing APIs. But interviewers want to see you go beyond the basics. Discuss Richardson Maturity Model levels, HATEOAS, and content negotiation.
| Level | Name | Description | Example |
|---|---|---|---|
| 0 | The Swamp of POX | Single endpoint, RPC-style | POST /api with action in body |
| 1 | Resources | Individual URIs per resource | /users, /orders |
| 2 | HTTP Verbs | Proper use of GET, POST, PUT, DELETE | GET /users/123 |
| 3 | HATEOAS | Hypermedia links in responses | Links to related resources |
"A REST API should be entered with no prior knowledge beyond the initial URI (bookmark) and set of standardized media types that are appropriate for the intended audience."
- Roy Fielding, who defined REST, in REST APIs must be hypertext-driven (2008)
GraphQL: The Trade-offs Nobody Discusses
GraphQL solves real problems (over-fetching, under-fetching), but introduces its own challenges. In an interview, discussing both sides shows engineering maturity:
✓ GraphQL Strengths
- • Client controls exact data shape
- • Single endpoint, fewer round-trips
- • Strong typing with schema validation
- • Built-in introspection for tooling
✗ GraphQL Challenges
- • N+1 query problem without DataLoader
- • Caching is significantly harder
- • Rate limiting per query is complex
- • File uploads require workarounds
gRPC: The Microservices Choice
gRPC excels for internal service-to-service communication where performance matters. Its binary Protocol Buffers format is typically smaller on the wire and faster to parse than JSON, and the schema doubles as a contract between services. That is why it is common between internal microservices at large companies.
- → Unary RPC: Simple request-response (equivalent to REST)
- → Server streaming: Client sends one request, server streams multiple responses
- → Client streaming: Client streams multiple requests, server sends one response
- → Bidirectional streaming: Both sides stream simultaneously (real-time chat, gaming)
API Versioning Strategies
| Strategy | Example | Pros | Cons |
|---|---|---|---|
| URL Path | /v1/users | Simple, visible | Breaks REST principles |
| Header | Accept: v=2 | Clean URLs | Hidden, harder to test |
| Query Param | ?version=2 | Easy to switch | Pollutes query string |
Rate Limiting Architecture
Every production API needs rate limiting. In an interview, you should be able to discuss two key algorithms:
Token Bucket
Tokens are added at a fixed rate. Each request consumes a token. Allows bursting up to the bucket capacity. Ideal for APIs that need to allow short bursts. Used by AWS API Gateway.
Sliding Window
Counts requests in a rolling time window. No bursting allowed. More predictable throughput. Higher memory usage. Used by Stripe and Shopify for payment APIs.
Idempotency: The Senior Engineer Signal
If there's one concept that separates juniors from seniors in an API interview, it's idempotency. When a client sends a POST to charge a credit card and the network drops before the response, the client retries. Without idempotency, you double-charge the user.
Stripe's own API accepts an Idempotency-Key header on POST requests for exactly this reason: a client can retry a payment after a timeout without charging the customer twice (Stripe API docs).Backend engineer interview prep builds an idempotent transfer endpoint step by step: what the server stores for each key, when it checks it, and what a retry gets back.
Practice API Design Interviews
Devana's system design mock interviews let you practice explaining protocol choices, versioning and failure handling out loud, with an AI interviewer that asks follow-up questions.
