REST Assured Interview Questions for Automation Testing
38 REST Assured questions with answers for automation testing roles — 13 easy, 21 medium, 4 hard.
About REST Assured
Covers the REST Assured library for API automation in Java: given-when-then syntax, specifications, path and query params, JSON path, POJO serialization, schema validation, authentication, filters and logging. Expect hands-on questions where you write a GET, POST or chained request test and explain how you would scale it into a framework.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Explain the given-when-then structure in REST Assured.
given() sets up the request: headers, params, body, auth. when() performs the HTTP call such as get(), post(), put() or delete(). then() validates the response: status code, headers, body using Hamcrest matchers, and response time. You can call extract() after then() to pull values for later steps. The fluent structure reads like a test specification and keeps setup, action and checks clearly separate.
02
Write a REST Assured POST test that sends a JSON body and checks the response.
Path params are part of the URL path and identify a resource, such as /users/{id}; you set them with pathParam("id", 5). Query params come after ? and filter or modify the result, such as /users?page=2; you set them with queryParam("page", 2). REST Assured URL-encodes both. Using named params instead of string concatenation makes tests cleaner and safer.
04
How do you extract a value from one response and use it in the next request?
Use given().log().all() for the full request and then().log().all() for the full response. To reduce noise, use log().ifValidationFails() on both, which prints only when a test fails. For a whole suite, set RestAssured.enableLoggingOfRequestAndResponseIfValidationFails() or add RequestLoggingFilter and ResponseLoggingFilter in a shared spec. Mask tokens and passwords before logs reach CI.
06
How do you measure and assert API response time in REST Assured?
Use then().time(lessThan(2000L)) for a quick check or response.getTimeIn(TimeUnit.MILLISECONDS) to log the value. This measures client-side time, including network, so set generous thresholds and treat it as a smoke signal, not a performance test. For real load and latency percentiles, use tools such as JMeter, Gatling or k6.
07
What is the difference between extract().response() and extract().path()?
extract().response() returns the full Response object, so you can read status, headers, cookies, body as string, and use jsonPath() several times. extract().path("field") returns one value directly from the body. Use path() when you need a single value like an id or token, and response() when you need many details or want to log the response.
08
How do you send form parameters and headers in REST Assured?
Use formParam("username", "asha") and formParam("password", "pass") for application/x-www-form-urlencoded bodies; REST Assured sets the content type for you. Add headers with header("X-Client", "web") or headers(map) for many at once. Cookies use cookie(name, value). Keep common headers in a RequestSpecification so individual tests only add what is specific to them.
09
How do you validate response headers and cookies in REST Assured?
Use then().header("Content-Type", containsString("application/json")) and then().cookie("sessionId", notNullValue()). To read values, use response.getHeader("X-Request-Id") or response.getCookie("sessionId"). Header checks matter for caching, security headers like Strict-Transport-Security, and correlation IDs used when debugging failures across services. Also assert that sensitive headers such as server version details are not exposed.
10
An API returns 200 but your REST Assured assertion on a field fails with a null value. How do you debug it?
Log the full response with then().log().all() to see the actual body. Common causes are a wrong JSON path, such as missing a wrapper like data, the field being in an array needing an index, a different content type like XML or HTML error page, or the field name having different case. Fix the path, and add a schema check so structure changes are caught clearly.
11
Write a REST Assured test for a DELETE request followed by a check that the resource is gone.
Do not assert on positions when the API does not guarantee order. Use order-independent Hamcrest matchers such as hasItem, hasItems or containsInAnyOrder on the extracted field, for example body("name", hasItems("Pen", "Book")). Or use GPath filtering like find { it.id == 42 } to pick the right item before checking its fields. If order matters for the feature, raise it as a requirement and request a sort parameter.
14
How do you validate a JSON response in REST Assured?
RequestSpecification holds common request settings such as base URI, base path, headers, content type, authentication and filters. You build it once with RequestSpecBuilder and reuse it with given().spec(reqSpec). This removes repetition, keeps environment settings in one place and makes switching between QA and staging easy. ResponseSpecification does the same for common assertions like status code and content type.
20
What is serialization and deserialization in REST Assured?
Serialization converts a Java object (POJO) into JSON for the request body; deserialization converts the response JSON back into a Java object. REST Assured does this automatically when Jackson or Gson is on the classpath: body(userPojo) serializes and response.as(User.class) deserializes. Using POJOs gives type safety, IDE support and cleaner assertions compared with hand-written JSON strings.
21
What is JsonPath and how do you use it for nested JSON?
JsonPath (Groovy GPath syntax in REST Assured) navigates JSON with dot notation. For {"data":{"items":[{"price":10}]}} you use data.items[0].price. You can also filter: data.items.findAll { it.price > 5 }.name returns names of items costing more than 5. Use it inside body() assertions or via response.jsonPath().getList("data.items.name") to extract values for further checks.
22
How do you validate a response against a JSON schema in REST Assured?
Add the json-schema-validator dependency, place the schema file in src/test/resources, and assert with then().body(matchesJsonSchemaInClasspath("user-schema.json")). Schema validation checks field types, required fields and structure, so it catches contract changes that value checks might miss. It complements, not replaces, assertions on business values like status or totals.
Filters intercept requests and responses, similar to middleware. They implement the Filter interface and can add headers, refresh tokens, log traffic, or attach request and response details to Allure reports with AllureRestAssured. You add them with given().filter(myFilter) or globally in a RequestSpecification. Filters keep cross-cutting concerns out of individual tests.
24
How do you handle authentication types in REST Assured?
Basic auth uses auth().preemptive().basic(user, pass). Bearer tokens are set as a header: header("Authorization", "Bearer " + token). OAuth 2.0 can use auth().oauth2(token) after fetching the token from the token endpoint. API keys go in a header or query param. Fetch tokens once per suite or cache them with an expiry check rather than logging in before every test.
25
Write a REST Assured test that deserializes a response into a POJO.
Use multipart: given().multiPart("file", new File("src/test/resources/report.pdf"), "application/pdf").formParam("type", "invoice").when().post("/upload").then().statusCode(200). REST Assured sets the multipart/form-data content type automatically. Verify both the status and the response, such as the returned file id or size, and test edge cases like empty, oversized and wrong-type files.
27
How do you assert on an array in a JSON response using Hamcrest?
Use collection matchers inside body(). For example body("data.id", hasItems(1, 2)), body("data", hasSize(6)), body("data.email", everyItem(containsString("@"))) and body("data.find { it.id == 3 }.name", equalTo("Neha")). These check the whole collection in one line. For complex rules, extract a List with jsonPath().getList() and assert with Java or AssertJ.
Send invalid or missing fields, wrong data types, values beyond limits, invalid IDs, expired or missing tokens, wrong HTTP methods and malformed JSON. Assert the correct status (400, 401, 403, 404, 405, 422) and a clear error body without stack traces. Negative tests often find more defects than happy paths because validation and security checks are frequently incomplete.
29
Write a REST Assured test using RequestSpecBuilder and ResponseSpecBuilder.
Call the first page, check page size, total count and the next link or cursor. Loop through pages until there is no next page, collecting IDs, then assert no duplicates and the total matches the reported count. Also test edge cases: page 0, a page beyond the last, invalid page size and sorting stability. Cap the loop to avoid endless runs if the API misbehaves.
31
How do you build dynamic JSON request bodies without hard-coded strings?
Use POJOs with a builder pattern or Lombok @Builder, so tests write User.builder().name("Ravi").role("QA").build(). For quick cases use a HashMap or Jackson ObjectNode. For large templates, keep a JSON file and change fields with a JSON library. Combine with a faker library for unique values. This avoids escaping issues and makes changes to the schema easy to update.
32
Your API tests started failing with SSL handshake errors on a new test server. What do you do?
First confirm the server uses a self-signed or internal certificate. The proper fix is to import the company CA certificate into a truststore and configure REST Assured with trustStore(path, password). As a temporary measure in a test environment only, relaxedHTTPSValidation() skips checks. Never use relaxed validation against production, and raise the certificate issue with the infra team.
33
How do you validate an XML response in REST Assured?
// REST Assured uses GPath for XML as well as JSON
given()
.accept(ContentType.XML)
.when()
.get("/orders/42")
.then()
.statusCode(200)
.contentType(ContentType.XML)
.body("order.@id", equalTo("42"))
.body("order.items.item.size()", equalTo(3))
.body("order.status", equalTo("SHIPPED"));
34
Tell me about a time your API tests caught a breaking change before the UI tests did.
Situation: a backend team renamed a response field during a refactor. Task: our nightly REST Assured suite had to protect the mobile and web clients. Action: schema validation failed within minutes of the merge, and I shared the failing response and the contract with the developer. Result: the field was restored with a deprecation plan before the UI suite even ran, and the team added our schema tests to their pull request checks.
35
An API test passes alone but fails when the suite runs in parallel. What could be wrong?
Likely shared state. Common causes are static RestAssured settings changed by one test, shared test data like the same user being updated by two tests, token reuse after another test logged out, or rate limits. Fix by using per-test RequestSpecification instead of global statics, creating unique data per test, isolating tokens, and checking server rate-limit responses such as 429.
36
How do you design a REST Assured framework for many microservices?
Create a base module with shared specs, auth handling, config per environment, filters for logging and reporting, and utilities. Each service gets its own client class wrapping endpoints and POJOs for its models. Tests call clients, never raw URLs. Use builders for test data, schema checks for contracts, tags to run per service, and run independent services in parallel in CI.
37
Your API token expires after 15 minutes and long REST Assured suites start failing with 401. What do you do?
Centralise token handling in an auth helper that caches the token with its expiry time and refreshes it shortly before it expires, or in a filter that catches a 401, refreshes once and retries. Do not log in before every test, as that slows the suite and may hit rate limits. Make the helper thread-safe for parallel runs.
38
Developers changed a field from a number to a string and your tests did not catch it. How do you prevent this?
Add JSON schema validation for key responses so type changes fail immediately, and deserialize into typed POJOs, which fail when types do not match. For services with multiple consumers, introduce contract tests so providers learn about breaks before deploying. Also ask for API changes to be shared in pull requests or a changelog that QA reviews.
Frequently asked questions
How important is REST Assured in Automation Testing interviews?
Covers the REST Assured library for API automation in Java: given-when-then syntax, specifications, path and query params, JSON path, POJO serialization, schema validation, authentication, filters and logging. Expect hands-on questions where you write a GET, POST or chained request test and explain how you would scale it into a framework.
How should I use the REST Assured sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.