Search the practice set
126 questions, 454 terms and 400 topics in 20 areas.
59 results for “API Documentation”
OpenAPI
A machine-readable specification format for HTTP APIs, from which documentation, clients, servers, mocks and validation can be generated.
API Gateway
A single entry point in front of a set of services that handles authentication, rate limiting, routing and protocol translation.
Semantic Diffing of API Schemas
Comparing the published contract between builds and failing the build on a breaking change, so compatibility is mechanical rather than remembered.
Stripe's API Versioning
Stripe pins each account to the API version current when it integrated and transforms requests and responses between versions internally, so integrations never break and the core …
Architecture Decision Log
The ordered, immutable collection of a system's decision records, read as a history rather than as a specification.
Architecture Decision Record
A short, immutable document capturing one architectural decision, its context, the alternatives, and its consequences.
Backend for Frontend
A separate, narrow backend per client experience, which aggregates and reshapes downstream services for exactly that client's needs.
Backward Compatibility
The property that a new version of a producer continues to work with clients written against the old version.
C4 Model
A set of four nested diagram levels — context, container, component, code — that keeps each diagram at one consistent level of abstraction.
Contract Testing
Verifying that a provider satisfies the expectations each of its consumers actually relies on, without running all the services together.
Data Discovery
Automatically scanning stores to find where sensitive data actually resides, as distinct from where the documentation says it should.
Dead Letter Queue
A separate queue that receives messages which could not be processed after a set number of attempts, so they neither block the consumer nor disappear.
Enterprise Integration Patterns
A catalogue of named, composable messaging patterns — router, translator, aggregator, splitter, filter, dead letter channel — that gives integration work a shared vocabulary.
Event-Driven Integration
Systems integrating by publishing and consuming events rather than by calling each other's APIs.
GraphQL
A query language and runtime where the client specifies exactly which fields it needs, against a typed schema, usually via a single endpoint.
Idempotency
The property that performing an operation many times has the same effect as performing it once.
Idempotency Key
A client-generated unique value sent with a request so the server can recognise a retry and return the original result instead of acting twice.
LinkedIn and the Origin of Kafka
Kafka was built to replace point-to-point data integration between many systems with a single durable log that any system could publish to and any number could read.
Mass Assignment
A vulnerability where a request body is bound directly to an internal object, allowing a caller to set fields the API never intended to expose.
REST
An architectural style for APIs built on resources identified by URLs, manipulated with uniform HTTP methods, and stateless requests.
Rate Limiting
Bounding how many requests a caller may make in a window, to protect capacity and enforce fair use.
Runbook
A short, actionable document telling an on-call engineer what an alert means, what to check, and what the safe mitigations are.
Semantic Versioning
A version scheme where the number itself states the compatibility promise — major for breaking, minor for additive, patch for fixes.
Webhook
An HTTP callback from a provider to a consumer-supplied URL when an event occurs, replacing polling with push.
gRPC
A contract-first RPC framework using Protocol Buffers over HTTP/2, with generated clients and servers and first-class streaming.
A serverless API works in testing and fails under load with connection errors. The database is at 5% CPU. Explain and fix.
The mechanism Serverless functions scale by creating independent execution environments , each with its own process and its own connection pool. Two hundred con
A team wants to build a new internal API on serverless functions. It will serve steady traffic of about 200 requests per second during business hours. What do you advise?
What the interviewer is testing Whether you can apply the serverless trade off to a specific workload rather than treating it as a default good or a default bad
Design an order submission API that is safe when the client cannot tell whether its request succeeded. What exactly do you store, and when?
What the interviewer is testing Whether you know that "make it idempotent" is a design with specific failure modes, not a checkbox. The core design The client g
You are reviewing a new public API before launch. What do you check, in priority order?
1. Object level authorization — check this first, on every endpoint The most common serious API vulnerability. For each endpoint accepting an identifier, verify
When is an architectural decision worth an ADR, and what makes an ADR useful two years later?
What the interviewer is testing Whether you document decisions as a habit, and whether you know that most documentation fails because it records the wrong thing
You are designing APIs for a platform with a web app, a mobile app, internal service-to-service traffic and third-party partners. What do you expose, and where?
What the interviewer is testing Whether you choose per constraint or adopt one technology as an identity. The wrong answers here are all defensible sounding and
API Documentation
OpenAPI as a machine-checked contract rather than as prose.
API & Integration
General material on integrating systems through contracts.
API Error Handling
Error shapes, retryability signals and machine-readable causes.
API Gateway
A single entry point for policy, routing and protocol translation.
API Gateways
The single entry point, and the business logic that must stay out of it.
API Versioning
URL, header and account-pinned versioning, and who carries the burden.
Architecture Documentation
What to write down, at what altitude, and what nobody will ever read.
Documentation Practice
Keeping documents close to the code and honest about staleness.
Secure API Design
Object-level authorisation, input validation and safe error responses.
APIs as Products
Ownership, lifecycle, deprecation policy and developer experience.
Backward Compatibility
Which changes are safe, and how to make breakage a build failure.
Contract Testing
Verifying what consumers actually rely on, without a shared environment.
Contract Tests
Capturing what consumers actually use, not what the API documents.
Event-Driven Integration
Publishing facts rather than commands, and versioning event schemas.
GraphQL
Client-specified queries, N+1 resolution and query-cost control.
Idempotency Keys
Client-generated keys stored atomically with the operation they guard.
Integration Patterns
Routers, translators, splitters, aggregators and dead letter channels.
Legacy Integration
Reaching systems that cannot change, without importing their model.
Message Formats
JSON, Protobuf, Avro — schema evolution and payload economics.
OWASP Risks
The recurring web and API risk classes, several of which are design flaws.
Pagination & Filtering
Offset versus cursor, stable ordering and unbounded result sets.
Partner & B2B Integration
External contracts, onboarding, sandboxes and long deprecation windows.
REST Design
Resources, uniform methods, status codes and statelessness.
Rate Limiting
Algorithms, shared counters, and signalling rejection properly.
Schema Registry
Enforcing compatibility on events the way CI enforces it on code.
Webhooks
Push callbacks, signature verification, ordering and at-least-once delivery.
gRPC APIs
Contract-first RPC, generated clients and protobuf compatibility rules.