Why Confidence Without APIs Skills Still Fails

Interviewer: What is the difference between 401 and 403?

Candidate: Both are authentication errors. 401 is
unauthorized and 403 is forbidden, so basically when
the user is not allowed.

Interviewer: So which one would you expect if I send
a valid token for a user who is not an admin, to an
admin-only endpoint?

Candidate: ...401? Or maybe 403. It depends on the API.

import static io.restassured.RestAssured.given;
import static org.hamcrest.Matchers.*;
import org.junit.jupiter.api.Test;

class AdminAccessTest {

  static final String BASE = System.getenv("API_BASE");

  @Test
  void noTokenGives401() {
    given().baseUri(BASE)
    .when().get("/admin/users")
    .then().statusCode(401);
  }

  @Test
  void normalUserGets403() {
    String userToken = TokenHelper.loginAs("normal_user");
    given().baseUri(BASE)
      .auth().oauth2(userToken)
    .when().get("/admin/users")
    .then().statusCode(403)
      .body("error", containsString("permission"));
  }
}

@Test
void patchChangesOnlyOneField() {
  String id = createUser("Asha", "asha@example.test", "Pune");

  given().baseUri(BASE).auth().oauth2(adminToken)
    .contentType("application/json")
    .body("{\"city\": \"Noida\"}")
  .when().patch("/users/" + id)
  .then().statusCode(200);

  given().baseUri(BASE).auth().oauth2(adminToken)
  .when().get("/users/" + id)
  .then().statusCode(200)
    .body("city", equalTo("Noida"))
    .body("name", equalTo("Asha"))            // unchanged
    .body("email", equalTo("asha@example.test")); // unchanged
}

@Test
void sameIdempotencyKeyCreatesOneOrder() {
  String key = java.util.UUID.randomUUID().toString();
  String body = "{\"productId\": 42, \"qty\": 1}";

  String first = given().baseUri(BASE).auth().oauth2(userToken)
      .header("Idempotency-Key", key)
      .contentType("application/json").body(body)
    .when().post("/orders")
    .then().statusCode(201)
    .extract().path("id").toString();

  String second = given().baseUri(BASE).auth().oauth2(userToken)
      .header("Idempotency-Key", key)
      .contentType("application/json").body(body)
    .when().post("/orders")
    .then().statusCode(anyOf(is(200), is(201)))
    .extract().path("id").toString();

  org.junit.jupiter.api.Assertions.assertEquals(first, second);
}

// Only valid if the API supports an Idempotency-Key header.
// Check the API docs first and say so in the interview.

import static io.restassured.RestAssured.given;

public class TokenHelper {

  private static String cached;

  public static synchronized String adminToken() {
    if (cached == null) {
      cached = given()
          .baseUri(System.getenv("API_BASE"))
          .contentType("application/x-www-form-urlencoded")
          .formParam("grant_type", "client_credentials")
          .formParam("client_id", System.getenv("CLIENT_ID"))
          .formParam("client_secret", System.getenv("CLIENT_SECRET"))
        .when().post("/oauth/token")
        .then().statusCode(200)
        .extract().path("access_token");
    }
    return cached;
  }

  public static synchronized void reset() {
    cached = null;   // call when a 401 shows the token expired
  }
}

"Our tests use the client credentials flow. Before the
first API call, the helper posts the client ID and
secret to the token endpoint and caches the access
token for the run.

The secret is never in the code; it comes from CI
environment variables.

If a call returns 401 because the token expired, the
retry filter resets the cache, gets a fresh token and
retries that call once. If it fails again, the test
fails, because then it is probably a real auth bug,
not an expiry."

Answer each aloud in under 30 seconds. No notes.

1. 401 vs 403, with a request that causes each.
2. 200 vs 201 vs 204: when does an API return each?
3. Which HTTP methods are idempotent? Why does it matter?
4. PUT vs PATCH: what happens to fields you leave out?
5. Where does your test suite get its auth token?
6. What happens if the token expires mid-run?
7. Apart from status code, name three things you
   assert on in a response.
8. How do you test that an API rejects invalid input?

Any answer starting with 'basically' or 'it depends'
with no follow-up: mark it as a gap.

Use a free practice API that supports GET, POST, PUT,
PATCH and DELETE, or a local mock server.

SESSION 1  Trigger and capture: 200, 201, 204, 400,
           401, 404. Save each request and response.

SESSION 2  Write PUT and PATCH tests. Check which
           fields survive each.

SESSION 3  Send the same POST twice. Note what happens
           and what you think should happen.

SESSION 4  Write a token helper using env variables.
           Force an expired token and handle it.

SESSION 5  Explain each session aloud in 2 minutes,
           recording yourself.

For any API concept question:

1. DEFINE in one sentence
   "PATCH updates part of a resource."

2. CONTRAST with its neighbour
   "Unlike PUT, which replaces the whole resource."

3. BEHAVIOUR when repeated or failing
   "PATCH is not guaranteed to be idempotent."

4. TEST you would write
   "I PATCH one field, then GET and check the other
    fields did not change."

Four sentences. Confident AND deep.