API Design Interview Questions: REST, GraphQL, and Beyond

In almost every backend or full-stack interview, you'll be asked to design an API. Many candidates simply write out a few CRUD endpoints and stop. This guarantees a rejection. Senior engineers understand that API design is about contracts, backward compatibility, security, and scalability.

Modern cloud infrastructure and API servers in a blue-lit data center

API Design Fundamentals

Before discussing specific protocols, understand that every API design decision involves trade-offs. The interviewer wants to see that you can articulate these trade-offs, not just pick the "right" answer.

The 5 Pillars of Production API Design

ConsistencyPredictable naming, response shapes

VersioningBackward compatibility strategy

SecurityAuthN, AuthZ, rate limiting

PerformanceCaching, pagination, compression

DocumentationOpenAPI specs, examples

REST: When and Why

REST remains the dominant API paradigm for public-facing APIs. But interviewers want to see you go beyond the basics. Discuss Richardson Maturity Model levels, HATEOAS, and content negotiation.

Level	Name	Description	Example
0	The Swamp of POX	Single endpoint, RPC-style	POST /api with action in body
1	Resources	Individual URIs per resource	/users, /orders
2	HTTP Verbs	Proper use of GET, POST, PUT, DELETE	GET /users/123
3	HATEOAS	Hypermedia links in responses	Links to related resources

"A well-designed REST API should be explorable without documentation. If your client needs to hardcode URLs, you've failed at REST."
- Roy Fielding, Creator of REST, Co-founder of the Apache HTTP Server

Diagrams pinned to a wall and connected during a design session

GraphQL: The Trade-offs Nobody Discusses

GraphQL solves real problems (over-fetching, under-fetching), but introduces its own challenges. In an interview, discussing both sides shows engineering maturity:

✓ GraphQL Strengths

• Client controls exact data shape
• Single endpoint, fewer round-trips
• Strong typing with schema validation
• Built-in introspection for tooling

✗ GraphQL Challenges

• N+1 query problem without DataLoader
• Caching is significantly harder
• Rate limiting per query is complex
• File uploads require workarounds

gRPC: The Microservices Choice

gRPC excels for internal service-to-service communication where performance matters. Its binary Protocol Buffers format is 5-10x faster to serialize than JSON. Companies like Netflix, Uber, and Spotify use gRPC extensively for their microservice meshes.

→ Unary RPC: Simple request-response (equivalent to REST)
→ Server streaming: Client sends one request, server streams multiple responses
→ Client streaming: Client streams multiple requests, server sends one response
→ Bidirectional streaming: Both sides stream simultaneously (real-time chat, gaming)

Laptop displaying API documentation and code in a professional development environment

API Versioning Strategies

Strategy	Example	Pros	Cons
URL Path	/v1/users	Simple, visible	Breaks REST principles
Header	Accept: v=2	Clean URLs	Hidden, harder to test
Query Param	?version=2	Easy to switch	Pollutes query string

Rate Limiting Architecture

Every production API needs rate limiting. In an interview, you should be able to discuss two key algorithms:

Token Bucket

Tokens are added at a fixed rate. Each request consumes a token. Allows bursting up to the bucket capacity. Ideal for APIs that need to allow short bursts. Used by AWS API Gateway.

Sliding Window

Counts requests in a rolling time window. No bursting allowed. More predictable throughput. Higher memory usage. Used by Stripe and Shopify for payment APIs.

Idempotency: The Senior Engineer Signal

If there's one concept that separates juniors from seniors in an API interview, it's idempotency. When a client sends a POST to charge a credit card and the network drops before the response, the client retries. Without idempotency, you double-charge the user.

"Idempotency keys are not a nice-to-have for payment APIs-they're a legal requirement. If you can't explain this in an interview, you're not ready for a senior role at any fintech company."
- Patrick Collison, CEO of Stripe

Server infrastructure with organized cabling at a major tech company data center

Developer coding API endpoints with green syntax highlighting on laptop

Practice API Design Interviews

Devana's system design rounds include dedicated API design scenarios where the AI evaluates your protocol choices, versioning strategy, and security considerations in real-time.