Web Development APIs and REST 4 — Questions and Answers
Question 1: What is the purpose of a webhook in API design?
- To poll an API for updates at regular intervals
- To allow a server to push event notifications to a client URL (Correct answer)
- To authenticate API requests using cryptographic keys
- To cache API responses on the client side
Correct answer: To allow a server to push event notifications to a client URL
Webhooks enable server-to-client push notifications by calling a client-provided URL when a specific event occurs, avoiding polling.
Question 2: What does CORS stand for and why does it matter for APIs?
- Client Origin Request System; controls API keys
- Cross-Origin Resource Sharing; controls which domains can access the API from a browser (Correct answer)
- Cached Object Retrieval Schema; speeds up API responses
- Cross-Origin Routing Service; handles DNS for APIs
Correct answer: Cross-Origin Resource Sharing; controls which domains can access the API from a browser
CORS (Cross-Origin Resource Sharing) is a browser security mechanism that restricts which origins can make requests to your API.
Question 3: Which HTTP status code should a REST API return when a client sends an invalid request body?
- 500 Internal Server Error
- 404 Not Found
- 400 Bad Request (Correct answer)
- 401 Unauthorized
Correct answer: 400 Bad Request
400 Bad Request indicates the server cannot process the request due to client-side errors such as malformed syntax or invalid parameters.
Question 4: What is the role of an API gateway in a microservices architecture?
- It stores API responses in a database
- It acts as a single entry point, handling routing, auth, and rate limiting (Correct answer)
- It generates API documentation automatically
- It runs microservices as serverless functions
Correct answer: It acts as a single entry point, handling routing, auth, and rate limiting
An API gateway is a reverse proxy that sits in front of microservices, centralizing cross-cutting concerns like authentication, rate limiting, and load balancing.
Question 5: In OpenAPI (Swagger) specification, what is a 'schema'?
- A database table definition
- A description of the structure and validation rules for request/response data (Correct answer)
- A list of available API endpoints
- An authentication configuration block
Correct answer: A description of the structure and validation rules for request/response data
In OpenAPI, a schema defines the shape, data types, and constraints of request bodies, response objects, and query parameters.
Question 6: What is the key difference between OAuth 2.0 and API Keys for authentication?
- API keys are more secure than OAuth 2.0 tokens
- OAuth 2.0 provides delegated access with scopes; API keys are static credentials (Correct answer)
- OAuth 2.0 only works for mobile apps
- API keys expire automatically; OAuth tokens do not
Correct answer: OAuth 2.0 provides delegated access with scopes; API keys are static credentials
OAuth 2.0 enables fine-grained delegated authorization with scopes and token expiry, while API keys are simple static credentials with no built-in scope control.
Question 7: What does the 'Retry-After' HTTP header communicate to API clients?
- The next API version release date
- How long the client should wait before making another request (Correct answer)
- The expiry time of an authentication token
- The cache duration for the response
Correct answer: How long the client should wait before making another request
Retry-After tells clients how long to wait (in seconds or until a specific date) before retrying after a 429 or 503 response.
Web Development APIs and REST 4
What is the purpose of a webhook in API design?