REST API Interview Questions and Answers

import csv
import hashlib
import json

from fastapi import FastAPI, Header, HTTPException, Request, Response
from fastapi.testclient import TestClient
from pydantic import BaseModel, Field

with open("taxi_zone_lookup.csv") as f:                        # NYC TLC taxi zone lookup, 265 zones
    ZONES = {int(r["LocationID"]): {"borough": r["Borough"], "zone": r["Zone"]} for r in csv.DictReader(f)}

app = FastAPI()
calls: dict[str, int] = {}


class Zone(BaseModel):
    borough: str = Field(min_length=1)
    zone: str = Field(min_length=1)


def etag(body: dict) -> str:
    return '"' + hashlib.sha256(json.dumps(body, sort_keys=True).encode()).hexdigest()[:16] + '"'


@app.middleware("http")
async def rate_limit(request: Request, call_next):              # 5 requests per client key, for the demo
    key = request.headers.get("x-api-key", "anonymous")
    calls[key] = calls.get(key, 0) + 1
    if key.startswith("limited") and calls[key] > 5:
        return Response(status_code=429, headers={"Retry-After": "60"})
    return await call_next(request)


@app.get("/zones")
def list_zones(borough: str | None = None, limit: int = 3, after: int = 0):
    ids = [i for i in sorted(ZONES) if i > after and (borough is None or ZONES[i]["borough"] == borough)]
    page = ids[:limit]
    return {"items": [{"id": i, **ZONES[i]} for i in page], "next_after": page[-1] if len(ids) > limit else None}


@app.get("/zones/{zone_id}")
def get_zone(zone_id: int, response: Response, if_none_match: str | None = Header(default=None)):
    if zone_id not in ZONES:
        raise HTTPException(404, "zone not found")
    tag = etag(ZONES[zone_id])
    if if_none_match == tag:
        return Response(status_code=304, headers={"ETag": tag})
    response.headers["ETag"] = tag
    return {"id": zone_id, **ZONES[zone_id]}


@app.put("/zones/{zone_id}", status_code=200)
def replace_zone(zone_id: int, body: Zone):
    ZONES[zone_id] = body.model_dump()
    return {"id": zone_id, **ZONES[zone_id]}


@app.post("/zones", status_code=201)
def create_zone(body: Zone):
    new_id = max(ZONES) + 1
    ZONES[new_id] = body.model_dump()
    return {"id": new_id, **ZONES[new_id]}


@app.delete("/zones/{zone_id}", status_code=204)
def delete_zone(zone_id: int, x_api_key: str = Header(default=""), x_role: str = Header(default="")):
    if not x_api_key:                                          # who are you? unknown -> 401
        raise HTTPException(401, "missing credentials", headers={"WWW-Authenticate": "ApiKey"})
    if x_role != "admin":                                      # known, but not allowed -> 403
        raise HTTPException(403, "admins only")
    ZONES.pop(zone_id, None)


api = TestClient(app)
show = lambda r: f"{r.status_code} {r.json() if r.content else ''}".strip()

print("R1 resources and status codes")
print("   GET /zones/132     ->", show(api.get("/zones/132")))
print("   GET /zones/999     ->", show(api.get("/zones/999")))
print("   GET /zones/abc     ->", api.get("/zones/abc").status_code, "| POST with empty zone ->", api.post("/zones", json={"borough": "Queens", "zone": ""}).status_code)

print("\nR2 POST is not idempotent, PUT is")
before = len(ZONES)
for _ in range(2):
    api.post("/zones", json={"borough": "Queens", "zone": "Test Zone"})
print(f"   two identical POSTs created {len(ZONES) - before} zones")
before = len(ZONES)
for _ in range(2):
    last = api.put("/zones/300", json={"borough": "Queens", "zone": "Test Zone"})
print(f"   two identical PUTs to /zones/300 created {len(ZONES) - before} zone, final state: {last.json()}")

print("\nR3 cursor pagination over the 69 Manhattan zones")
after, pages, first = 0, 0, None
while after is not None:
    page = api.get("/zones", params={"borough": "Manhattan", "limit": 20, "after": after}).json()
    first = first or [z["zone"] for z in page["items"]][:2]
    after, pages = page["next_after"], pages + 1
print(f"   {pages} pages of up to 20; first two zones: {first}")

print("\nR4 conditional GET with an ETag")
r = api.get("/zones/132")
again = api.get("/zones/132", headers={"If-None-Match": r.headers["etag"]})
print(f"   first GET {r.status_code} with {len(r.content)} bytes | repeat with If-None-Match: {again.status_code} with {len(again.content)} bytes")
api.put("/zones/132", json={"borough": "Queens", "zone": "JFK Airport (renamed)"})
print("   after the zone changes, the old ETag gets:", api.get("/zones/132", headers={"If-None-Match": r.headers["etag"]}).status_code)

print("\nR5 401 vs 403, and 429")
print("   DELETE with no credentials      ->", show(api.delete("/zones/300")))
print("   DELETE as an analyst            ->", show(api.delete("/zones/300", headers={"x-api-key": "k1", "x-role": "analyst"})))
print("   DELETE as an admin              ->", api.delete("/zones/300", headers={"x-api-key": "k1", "x-role": "admin"}).status_code)
codes = [api.get("/zones/1", headers={"x-api-key": "limited-client"}).status_code for _ in range(7)]
blocked = api.get("/zones/1", headers={"x-api-key": "limited-client"})
print("   seven calls from a limited key ->", codes, "| Retry-After:", blocked.headers.get("retry-after"))

R1 resources and status codes
   GET /zones/132     -> 200 {'id': 132, 'borough': 'Queens', 'zone': 'JFK Airport'}
   GET /zones/999     -> 404 {'detail': 'zone not found'}
   GET /zones/abc     -> 422 | POST with empty zone -> 422

R2 POST is not idempotent, PUT is
   two identical POSTs created 2 zones
   two identical PUTs to /zones/300 created 1 zone, final state: {'id': 300, 'borough': 'Queens', 'zone': 'Test Zone'}

R3 cursor pagination over the 69 Manhattan zones
   4 pages of up to 20; first two zones: ['Alphabet City', 'Battery Park']

R4 conditional GET with an ETag
   first GET 200 with 50 bytes | repeat with If-None-Match: 304 with 0 bytes
   after the zone changes, the old ETag gets: 200

R5 401 vs 403, and 429
   DELETE with no credentials      -> 401 {'detail': 'missing credentials'}
   DELETE as an analyst            -> 403 {'detail': 'admins only'}
   DELETE as an admin              -> 204
   seven calls from a limited key -> [200, 200, 200, 200, 200, 429, 429] | Retry-After: 60