CS API Development & Integration 2 — Questions and Answers
Question 1: A client sends a PUT request to /api/users/42 with a complete user object. What behavior does REST semantics prescribe?
- Replace the entire resource at that URI with the supplied representation (Correct answer)
- Merge only the provided fields into the existing resource
- Create a new resource with an auto-generated ID
- Queue the update for asynchronous processing
Correct answer: Replace the entire resource at that URI with the supplied representation
PUT is defined as a full replacement of the resource at the target URI, while PATCH is used for partial updates.
Question 2: An API returns HTTP 429 to a client. What is the client expected to do?
- Retry immediately with the same request
- Slow down and retry after the interval indicated by the Retry-After header (Correct answer)
- Re-authenticate because its token has expired
- Switch from HTTPS to HTTP
Correct answer: Slow down and retry after the interval indicated by the Retry-After header
Status 429 Too Many Requests signals rate limiting, and the client should back off, typically honoring the Retry-After header.
Question 3: Which OAuth 2.0 grant type is recommended for a single-page application authenticating a user in 2020s best practice?
- Implicit grant
- Resource owner password credentials
- Authorization code flow with PKCE (Correct answer)
- Client credentials grant
Correct answer: Authorization code flow with PKCE
The authorization code flow with PKCE replaced the implicit grant as the secure standard for public clients like SPAs.
Question 4: In a REST API, which practice best supports safe retries of a payment creation request over an unreliable network?
- Using GET instead of POST for the payment
- Requiring the client to send an idempotency key with the POST request (Correct answer)
- Disabling timeouts on the client
- Returning 200 for duplicate submissions without checking
Correct answer: Requiring the client to send an idempotency key with the POST request
An idempotency key lets the server detect and deduplicate retried POST requests so the payment is only created once.
Question 5: A mobile app must fetch a user's name, their last 5 orders, and each order's shipping status, but the REST API requires three separate round trips. Which technology directly addresses this over-fetching and multiple-request problem?
- GraphQL (Correct answer)
- SOAP
- FTP
- WebDAV
Correct answer: GraphQL
GraphQL lets clients request exactly the nested data they need in a single query, avoiding multiple REST round trips.
Question 6: Which HTTP header does a browser rely on during a CORS preflight to learn which origins may call an API?
- Content-Security-Policy
- Access-Control-Allow-Origin (Correct answer)
- X-Frame-Options
- Strict-Transport-Security
Correct answer: Access-Control-Allow-Origin
The server's Access-Control-Allow-Origin response header tells the browser which origins are permitted to access the resource.
Question 7: An API team wants machine-readable documentation that can also generate client SDKs and server stubs for their REST service. Which specification should they use?
- WSDL
- OpenAPI (Swagger) (Correct answer)
- JSON-LD
- XSLT
Correct answer: OpenAPI (Swagger)
OpenAPI is the standard machine-readable description format for REST APIs and drives code generation and interactive docs.
CS API Development & Integration 2
A client sends a PUT request to /api/users/42 with a complete user object.
What behavior does REST semantics prescribe?