APIs, Networking & Integration Topics
API design, management, and integration patterns including REST, GraphQL, and other protocols. Covers API contract design, versioning strategies, error handling, idempotency, deprecation planning, and SDK/integration frameworks. Includes system-to-system integration, webhook patterns, and integration platform considerations. Excludes network infrastructure and network-layer protocols (see Network Architecture under Cloud & Infrastructure or a dedicated networking category if needed).
API and Integration Troubleshooting
Diagnosing failures across API and integration boundaries: reading status codes and error payloads, tracing requests across services, latency and timeout investigation, TLS/CORS/auth failures, and pinpointing whether a fault is client, network, gateway, or provider. Covers logging/observability for integrations and systematic debugging of intermittent sync and connectivity issues.
HTTP Protocol and Web Fundamentals
Application-layer HTTP semantics that underpin API behavior: methods, status codes, request/response headers, content negotiation, caching (ETags, Cache-Control), cookies, connection reuse, and HTTP/1.1 vs. HTTP/2 vs. HTTP/3 differences. Includes TLS/HTTPS at the request level and how proxies and load balancers affect requests. Foundational knowledge assumed before deeper API topics.
API Versioning, Deprecation and Backward Compatibility
Evolving an API without breaking existing consumers: versioning strategies (URI, header, media-type), distinguishing breaking from non-breaking changes, deprecation policies and sunset timelines, and coordinating migrations at scale. Covers communicating changes, supporting multiple versions concurrently, and compatibility guarantees across heterogeneous clients.
API Gateways and API Management
The management layer in front of APIs: gateways for routing, authentication, rate limiting, request/response transformation, and observability. Covers API management concerns such as developer portals, key provisioning, plan/tier enforcement, analytics, and centralized policy. The operational and productization surface of an API program.
Rate Limiting, Throttling and Quota Management
Protecting API capacity and enforcing fair use: rate-limiting algorithms (token bucket, leaky bucket, fixed/sliding window), per-client quotas, throttling responses (429 semantics, Retry-After), and tiered plan enforcement. Covers where to enforce limits (gateway vs. service), distributed counters, and graceful degradation under load.
RESTful API Design
Designing resource-oriented HTTP APIs following REST constraints: resource modeling, URI structure, correct use of HTTP methods, statelessness, and HATEOAS trade-offs. Covers naming conventions, collection vs. singleton resources, filtering/sorting/pagination, and choosing appropriate status codes. The default paradigm most interview questions in this category probe.
API Security, Authentication and Authorization
Controlling who can call an API, what they may do, and defending it against abuse. Covers the access-control mechanics: API keys, OAuth 2.0 flows, OpenID Connect, JWT issuance/validation, session vs. token auth, scopes/roles for fine-grained authorization, token lifetime and refresh, mutual TLS, and machine-to-machine vs. user-delegated access. Also covers the adversarial hardening view: input validation, injection and deserialization risks, broken object-level authorization (BOLA), mass assignment, secrets handling, and the OWASP API Security Top 10, plus securing data in transit, preventing enumeration/scraping, and testing APIs for vulnerabilities.
Webhooks and Event-Driven Integration
Push-based integration where a provider notifies consumers of events: webhook delivery, signing/verification, retry and dead-letter handling, ordering and deduplication, and idempotent receivers. Covers designing outbound webhook systems, replay/backfill, and comparing webhooks to polling for third-party integration.
API Documentation and Developer Experience
Making an API easy and pleasant to adopt: reference docs, quickstarts, examples, changelogs, and interactive/OpenAPI-driven documentation. Covers developer experience (DX) as a product concern, onboarding time, consistency and discoverability, and treating the API as a product with its consumers as users.