Search the practice set
126 questions, 454 terms and 400 topics in 20 areas.
53 results for “API Gateways”
API Gateway
A single entry point in front of a set of services that handles authentication, rate limiting, routing and protocol translation.
Semantic Diffing of API Schemas
Comparing the published contract between builds and failing the build on a breaking change, so compatibility is mechanical rather than remembered.
Stripe's API Versioning
Stripe pins each account to the API version current when it integrated and transforms requests and responses between versions internally, so integrations never break and the core …
Backend for Frontend
A separate, narrow backend per client experience, which aggregates and reshapes downstream services for exactly that client's needs.
Backward Compatibility
The property that a new version of a producer continues to work with clients written against the old version.
Contract Testing
Verifying that a provider satisfies the expectations each of its consumers actually relies on, without running all the services together.
Dead Letter Queue
A separate queue that receives messages which could not be processed after a set number of attempts, so they neither block the consumer nor disappear.
Enterprise Integration Patterns
A catalogue of named, composable messaging patterns — router, translator, aggregator, splitter, filter, dead letter channel — that gives integration work a shared vocabulary.
Event-Driven Integration
Systems integrating by publishing and consuming events rather than by calling each other's APIs.
GraphQL
A query language and runtime where the client specifies exactly which fields it needs, against a typed schema, usually via a single endpoint.
Idempotency
The property that performing an operation many times has the same effect as performing it once.
Idempotency Key
A client-generated unique value sent with a request so the server can recognise a retry and return the original result instead of acting twice.
LinkedIn and the Origin of Kafka
Kafka was built to replace point-to-point data integration between many systems with a single durable log that any system could publish to and any number could read.
Mass Assignment
A vulnerability where a request body is bound directly to an internal object, allowing a caller to set fields the API never intended to expose.
OpenAPI
A machine-readable specification format for HTTP APIs, from which documentation, clients, servers, mocks and validation can be generated.
REST
An architectural style for APIs built on resources identified by URLs, manipulated with uniform HTTP methods, and stateless requests.
Rate Limiting
Bounding how many requests a caller may make in a window, to protect capacity and enforce fair use.
Semantic Versioning
A version scheme where the number itself states the compatibility promise — major for breaking, minor for additive, patch for fixes.
Uber's Domain-Oriented Microservice Architecture
After growing to roughly 2,200 microservices, Uber grouped them into domains behind gateways with strict dependency layering, to recover the comprehensibility that fine-grained de…
Webhook
An HTTP callback from a provider to a consumer-supplied URL when an event occurs, replacing polling with push.
gRPC
A contract-first RPC framework using Protocol Buffers over HTTP/2, with generated clients and servers and first-class streaming.
A serverless API works in testing and fails under load with connection errors. The database is at 5% CPU. Explain and fix.
The mechanism Serverless functions scale by creating independent execution environments , each with its own process and its own connection pool. Two hundred con
A team wants to build a new internal API on serverless functions. It will serve steady traffic of about 200 requests per second during business hours. What do you advise?
What the interviewer is testing Whether you can apply the serverless trade off to a specific workload rather than treating it as a default good or a default bad
Design an order submission API that is safe when the client cannot tell whether its request succeeded. What exactly do you store, and when?
What the interviewer is testing Whether you know that "make it idempotent" is a design with specific failure modes, not a checkbox. The core design The client g
You are reviewing a new public API before launch. What do you check, in priority order?
1. Object level authorization — check this first, on every endpoint The most common serious API vulnerability. For each endpoint accepting an identifier, verify
You are designing APIs for a platform with a web app, a mobile app, internal service-to-service traffic and third-party partners. What do you expose, and where?
What the interviewer is testing Whether you choose per constraint or adopt one technology as an identity. The wrong answers here are all defensible sounding and
API Gateways
The single entry point, and the business logic that must stay out of it.
AI Gateways
Centralised routing, keys, quotas, caching, logging and safety policy.
API & Integration
General material on integrating systems through contracts.
API Documentation
OpenAPI as a machine-checked contract rather than as prose.
API Error Handling
Error shapes, retryability signals and machine-readable causes.
API Gateway
A single entry point for policy, routing and protocol translation.
API Versioning
URL, header and account-pinned versioning, and who carries the burden.
Secure API Design
Object-level authorisation, input validation and safe error responses.
APIs as Products
Ownership, lifecycle, deprecation policy and developer experience.
Backward Compatibility
Which changes are safe, and how to make breakage a build failure.
Contract Testing
Verifying what consumers actually rely on, without a shared environment.
Contract Tests
Capturing what consumers actually use, not what the API documents.
Event-Driven Integration
Publishing facts rather than commands, and versioning event schemas.
GraphQL
Client-specified queries, N+1 resolution and query-cost control.
Idempotency Keys
Client-generated keys stored atomically with the operation they guard.
Integration Patterns
Routers, translators, splitters, aggregators and dead letter channels.
Legacy Integration
Reaching systems that cannot change, without importing their model.
Message Formats
JSON, Protobuf, Avro — schema evolution and payload economics.
OWASP Risks
The recurring web and API risk classes, several of which are design flaws.
Pagination & Filtering
Offset versus cursor, stable ordering and unbounded result sets.
Partner & B2B Integration
External contracts, onboarding, sandboxes and long deprecation windows.
REST Design
Resources, uniform methods, status codes and statelessness.
Rate Limiting
Algorithms, shared counters, and signalling rejection properly.
Schema Registry
Enforcing compatibility on events the way CI enforces it on code.
Webhooks
Push callbacks, signature verification, ordering and at-least-once delivery.
gRPC APIs
Contract-first RPC, generated clients and protobuf compatibility rules.