Web API Interview Questions – RESTful API Design for .NET Developers

Web APIs are the backbone of modern distributed applications. As a .NET full-stack developer, you need to understand RESTful principles, API versioning, authentication, and performance optimization. This guide covers the most critical Web API interview questions.

Why Web API Knowledge Is Essential

Modern applications rely on APIs for communication between frontends, mobile apps, microservices, and third-party integrations. Interviewers test your ability to design clean, secure, and scalable APIs.

1. What Is REST and What Are Its Principles?

REST (Representational State Transfer) is an architectural style for designing networked applications. Its core principles are:

• Statelessness — Each request contains all information needed; server stores no session state
• Client-Server separation — Frontend and backend are independent
• Uniform Interface — Consistent resource-based URLs and standard HTTP methods
• Cacheability — Responses should indicate if they can be cached
• Layered System — Client cannot tell if connected directly to the server

Interview Tip: REST is an architectural style, not a protocol. Not all HTTP APIs are RESTful — true REST requires following these constraints.

2. What Are HTTP Methods and When Should You Use Each?

• GET — Retrieve a resource (idempotent, safe)
• POST — Create a new resource (not idempotent)
• PUT — Replace an entire resource (idempotent)
• PATCH — Partially update a resource (not necessarily idempotent)
• DELETE — Remove a resource (idempotent)

GET    /api/users          // Get all users
GET    /api/users/42       // Get user by ID
POST   /api/users          // Create new user
PUT    /api/users/42       // Replace user 42
PATCH  /api/users/42       // Update specific fields
DELETE /api/users/42       // Delete user 42

3. What Is the Difference Between Web API and MVC?

In ASP.NET Core, MVC and Web API are unified into a single framework. However, conceptually: MVC controllers return Views (HTML) while API controllers return data (JSON/XML). API controllers use the [ApiController] attribute which enables automatic model validation, binding source inference, and ProblemDetails error responses.

4. What Are HTTP Status Codes You Should Know?

• 200 OK — Success with response body
• 201 Created — Resource created successfully
• 204 No Content — Success with no response body
• 400 Bad Request — Invalid input from client
• 401 Unauthorized — Authentication required
• 403 Forbidden — Authenticated but not authorized
• 404 Not Found — Resource does not exist
• 409 Conflict — Conflict with current state
• 500 Internal Server Error — Server-side error

Interview Tip: Always return appropriate status codes. Using 200 for everything is a red flag in interviews.

5. How Do You Implement Authentication in Web APIs?

The most common approaches are:

• JWT (JSON Web Tokens) — Stateless, token-based authentication ideal for SPAs and mobile apps
• OAuth 2.0 — Authorization framework for third-party access
• API Keys — Simple key-based authentication for server-to-server communication

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"],
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]))
        };
    });

6. What Is API Versioning and How Do You Implement It?

API versioning allows you to make breaking changes without affecting existing clients. Common strategies include URL path versioning (/api/v1/users), query string versioning (?api-version=1.0), and header versioning (Api-Version: 1.0).

builder.Services.AddApiVersioning(options =>
{
    options.DefaultApiVersion = new ApiVersion(1, 0);
    options.AssumeDefaultVersionWhenUnspecified = true;
    options.ReportApiVersions = true;
});

7. What Is Content Negotiation?

Content negotiation is the process of selecting the best response format based on the client’s Accept header. ASP.NET Core supports JSON by default and can be configured to support XML or custom formatters.

8. What Is CORS and Why Is It Important?

CORS (Cross-Origin Resource Sharing) is a security mechanism that controls which domains can access your API. Without CORS configuration, browsers block requests from different origins.

builder.Services.AddCors(options =>
{
    options.AddPolicy("AllowAngularApp", policy =>
        policy.WithOrigins("https://myapp.com")
              .AllowAnyMethod()
              .AllowAnyHeader());
});

9. What Is Rate Limiting in Web APIs?

Rate limiting protects your API from abuse by limiting the number of requests a client can make in a given time period. .NET 7+ includes built-in rate limiting middleware with fixed window, sliding window, token bucket, and concurrency limiters.

10. How Do You Document APIs?

Use Swagger/OpenAPI (via Swashbuckle or NSwag) to auto-generate interactive API documentation. Add XML comments to controllers and models for detailed descriptions.

11. REST Architecture

Q: What is REST and why do we use it?

REST uses standard HTTP methods (GET, POST, PUT, DELETE) and stateless communication. RESTful APIs are lightweight, scalable, and platform-independent.

12. Web API Return Types

Q: What are the return types in Web API?

void (204), specific objects, HttpResponseMessage, IActionResult, and ActionResult<T>.

13. IActionResult and ActionResult

Q: What is IActionResult?

An abstraction for HTTP responses. Categories: Content results (Ok, Json), Redirection results (Redirect), Status code results (NotFound, BadRequest).

[HttpGet("{id}")]
public IActionResult GetProduct(int id)
{
    var product = _repo.GetById(id);
    if (product == null) return NotFound();
    return Ok(product);
}

14. Exception Handling in Web API

Q: What happens when Web API throws an unhandled exception?

Returns HTTP 500 by default. Best practice: use global exception handling middleware to return meaningful responses without exposing internals.

15. Partial Updates with PATCH

Q: How do you update partial data using REST?

Use HTTP PATCH instead of PUT. In ASP.NET Core, use JsonPatchDocument to apply only specified changes.

[HttpPatch("{id}")]
public IActionResult Patch(int id, [FromBody] JsonPatchDocument<Product> patch)
{
    var product = _repo.GetById(id);
    if (product == null) return NotFound();
    patch.ApplyTo(product);
    return Ok(product);
}

16. Securing Secrets in .NET Core

Q: How do you secure connection strings and keys?

Use Secret Manager in development, environment variables for staging, Azure Key Vault for production. Never hardcode secrets. Use IConfiguration with Options pattern.