CS API Development & Integration 3

Question 1

A server responds to POST /api/orders with 201 Created. Which header should accompany the response to point at the new resource?

Accepted Answer

Location

Answer

A 201 Created response conventionally includes a Location header containing the URI of the newly created resource.

Question 2

Which statement about a JWT (JSON Web Token) used as an API bearer token is TRUE?

Accepted Answer

Its payload is only Base64URL-encoded, so anyone holding the token can read the claims

Answer

A signed JWT's payload is Base64URL-encoded, not encrypted, so signing guarantees integrity but not confidentiality.

Question 3

A webhook provider signs each delivery with an HMAC in a header. Why should the consumer verify this signature?

Accepted Answer

To confirm the request genuinely came from the provider and was not tampered with

Answer

Verifying the HMAC with a shared secret authenticates the webhook's origin and detects payload tampering.

Question 4

Which versioning approach places the API version in the URL path?

Accepted Answer

GET /v2/customers

Answer

Putting the version segment in the path, such as /v2/customers, is URI-based versioning.

Question 5

Under HTTP semantics, which method is defined as both safe and idempotent?

Accepted Answer

GET

Answer

GET is safe (no state change) and idempotent, whereas DELETE is idempotent but not safe, and POST is neither.

(CS) Computer Science Practice Test