I am learning flutter from JustAcademy, They provide very much great environment where people gather and work simultaneously. totally project based training institute.
Awesome Experience. I am a Front-end Web Designer working at Star India for 3 years now. I applied for Full-stack development and my experience has been phenomenal & they really do help with placements exceptionally. Thank you Roshan sir so much.
Core Java Training in Mumbai | Core Java Online | Advance Java Training in Mumbai | Advance Java Online | Register for a Free Demo | Download Brochure
REST APIs are the backbone of modern web and mobile applications. Every Java developer working in backend development, full stack development, or microservices architecture is expected to have a strong understanding of REST principles, HTTP communication, Spring Boot implementation, and API security. Whether you are a fresher appearing for your first Java developer role or an experienced professional targeting a senior position, REST API questions are a guaranteed component of your technical interview.
This blog covers the most asked rest api interview questions java developers face in 2026, from foundational REST concepts and HTTP methods to Spring Boot implementation details, authentication mechanisms, versioning strategies, and API best practices. Every question is answered clearly and thoroughly so you can study systematically, identify gaps in your knowledge, and walk into your next interview with confidence. This guide is equally useful whether you are preparing through the best Java course in Mumbai or through a live interactive online Java training program from anywhere in the world.
REST stands for Representational State Transfer and is an architectural style for designing networked applications. A REST API is an application programming interface that follows REST principles and uses HTTP as the communication protocol. REST APIs expose resources, which are data entities like users, products, or orders, through URLs and allow clients to perform operations on those resources using standard HTTP methods. REST APIs communicate using lightweight formats like JSON or XML and are stateless, meaning each request from a client contains all the information needed to process it without the server storing session data between requests.
The six constraints that define REST architecture are as follows. Client-server separation, which means the client and server are independent and communicate only through the API interface. Statelessness, which means each request must contain all information needed for the server to process it and the server stores no client session state between requests. Cacheability, which means responses must define whether they can be cached to improve performance. Uniform interface, which standardizes how resources are accessed and manipulated through consistent conventions. Layered system, which means the client does not need to know whether it is communicating directly with the server or through intermediaries. And optionally, code on demand, which allows servers to send executable code to clients.
REST is an architectural style that uses standard HTTP methods and typically JSON for lightweight data exchange. It is stateless, flexible, easy to implement, and widely used in web and mobile applications. SOAP is a protocol with strict standards that uses XML for all messages and requires formal contracts defined in WSDL documents. SOAP supports built-in security through WS-Security and transactional reliability but is verbose, complex, and slower than REST. In Java development in 2026, REST APIs built with Spring Boot are the standard approach for new applications while SOAP is primarily encountered in legacy enterprise integrations.
The five main HTTP methods used in REST APIs are GET, which retrieves a resource or list of resources without modifying data. POST, which creates a new resource and typically returns the created resource with its assigned ID. PUT, which replaces an existing resource completely with the data provided in the request body. PATCH, which partially updates an existing resource, modifying only the fields provided. And DELETE, which removes a specified resource. These methods correspond to the CRUD operations of Create, Read, Update, and Delete.
PUT replaces the entire resource with the data provided in the request body. If a field is not included in the PUT request body, it is set to null or its default value in the resource. PATCH partially updates a resource, modifying only the fields explicitly included in the request body and leaving all other fields unchanged. PATCH is more efficient for partial updates because it requires less data to be transmitted. PUT is used when the client sends a complete representation of the resource as it should exist after the update.
HTTP status codes are three-digit numbers returned by the server in every response to indicate the outcome of the request. The most important status codes for REST APIs are organized by range. 200 OK means the request succeeded. 201 Created means a new resource was successfully created. 204 No Content means the request succeeded but there is no response body, commonly returned by DELETE. 400 Bad Request means the request was malformed or contained invalid data. 401 Unauthorized means authentication is required or has failed. 403 Forbidden means the client is authenticated but does not have permission to access the resource. 404 Not Found means the requested resource does not exist. 409 Conflict means the request conflicts with the current state of the resource. 422 Unprocessable Entity means the request was well-formed but contained semantic errors. 500 Internal Server Error means an unexpected condition prevented the server from fulfilling the request.
401 Unauthorized means the client has not provided valid authentication credentials or the provided credentials are invalid. The client should authenticate and retry the request. 403 Forbidden means the client has provided valid authentication credentials but does not have the required permission to access the requested resource. Authentication would not change the outcome. In a Java Spring Boot application, 401 is returned when JWT token validation fails and 403 is returned when a valid user attempts to access a resource their role does not permit.
A resource is any data entity that can be identified, addressed, and manipulated through the API. Resources are represented by nouns in URL paths, not verbs. RESTful URL conventions use plural nouns for collections such as /users or /products, and specific identifiers for individual resources such as /users/123 or /products/456. Hierarchical relationships are represented through nested paths such as /users/123/orders. Actions that do not map cleanly to CRUD operations can be represented as sub-resources such as /orders/456/cancel. URLs should be lowercase, use hyphens not underscores, and never include verbs or actions.
URI stands for Uniform Resource Identifier and is the broadest term, referring to any string that identifies a resource. URL stands for Uniform Resource Locator and is a specific type of URI that provides the location of a resource including the protocol and host. URN stands for Uniform Resource Name and is a URI that identifies a resource by name within a namespace without specifying its location. In REST API development, the terms URI and URL are used interchangeably in most contexts because REST resource addresses are always URLs.
Statelessness means that each HTTP request from a client to the server must contain all the information the server needs to understand and process that request. The server does not store any client session state between requests. Each request is independent and self-contained. Statelessness is important because it improves scalability by allowing any server in a cluster to handle any request without needing to synchronize session data, simplifies server design by eliminating session management complexity, and makes APIs easier to cache and test. In practice, statelessness in REST APIs is achieved by including authentication tokens like JWTs in every request header rather than relying on server-side sessions.
Content negotiation is the mechanism by which a client and server agree on the format of the response data. The client specifies its preferred format using the Accept header in the request, for example Accept application/json or Accept application/xml. The server responds in the requested format if it supports it or returns a 406 Not Acceptable status if it does not. In Spring Boot, content negotiation is handled automatically based on the configured message converters and the Accept header. Most REST APIs in Java development default to JSON as the primary format.
An operation is idempotent if performing it multiple times produces the same result as performing it once. GET is idempotent because reading the same resource repeatedly produces the same result without side effects. PUT is idempotent because replacing a resource with the same data repeatedly leaves the resource in the same state. DELETE is idempotent because deleting a resource that has already been deleted returns a 404 but does not change the system state further. POST is not idempotent because submitting the same POST request multiple times typically creates multiple resources. PATCH may or may not be idempotent depending on the implementation.
HATEOAS stands for Hypermedia as the Engine of Application State and is a REST constraint where API responses include links to related actions and resources, allowing clients to navigate the API dynamically without hardcoded knowledge of all available endpoints. For example, a response for a GET /orders/123 request might include links to cancel the order, view the customer, and track shipment. While HATEOAS is theoretically the most complete implementation of REST, it is relatively rarely implemented in practice in modern Java REST APIs because of the added complexity. Spring HATEOAS provides support for it in Spring Boot but most teams implement simpler REST APIs without full HATEOAS compliance.
A synchronous REST API processes a request and returns a response only after the operation is fully complete. The client waits for the response before proceeding. This is appropriate for quick operations. An asynchronous REST API accepts a request, immediately returns a response indicating the request has been received, and processes the operation in the background. The client can poll a status endpoint or receive a callback when processing is complete. Asynchronous patterns are used for time-consuming operations like file processing, report generation, or sending bulk notifications where making the client wait for the full operation would create poor user experience or risk timeout errors.
Creating a REST API in Spring Boot involves several steps. First, create a Spring Boot project with the Spring Web dependency using Spring Initializr. Define a model class annotated with Entity if it maps to a database table. Create a repository interface extending JpaRepository for data access. Create a service class annotated with Service containing business logic. Create a controller class annotated with RestController with a base URL defined in a RequestMapping annotation. Define handler methods in the controller annotated with GetMapping, PostMapping, PutMapping, PatchMapping, or DeleteMapping for each endpoint. Return ResponseEntity objects to include HTTP status codes with responses.
ResponseEntity is a class in Spring that represents the entire HTTP response including the status code, headers, and body. Using ResponseEntity gives developers explicit control over the HTTP status code returned with each response, which is important for proper REST semantics. For example, a successful creation should return 201 Created, a successful deletion with no content should return 204 No Content, and a resource not found should return 404 Not Found. Without ResponseEntity, Spring defaults to 200 OK for all successful responses, which is not semantically correct for all operations.
RequestBody is used on a method parameter to indicate that the HTTP request body should be deserialized from JSON into the specified Java object automatically by Jackson. It is used in POST and PUT methods to receive the data being created or updated. ResponseBody is used on a method or class to indicate that the return value of the method should be serialized to JSON and written directly to the HTTP response body. When RestController is used at the class level, ResponseBody is automatically applied to all methods in the class.
Global exception handling in Spring Boot is implemented using a class annotated with ControllerAdvice or RestControllerAdvice. Inside this class, handler methods annotated with ExceptionHandler specify which exception type they handle. Each handler method defines the appropriate HTTP status code and error response structure to return when the specified exception is thrown anywhere in the application. This approach centralizes all error handling in one place rather than wrapping every controller method in try-catch blocks. Common exceptions to handle globally include ResourceNotFoundException for 404 responses, MethodArgumentNotValidException for validation failures, and generic Exception for unexpected 500 errors.
Request validation in Spring Boot uses the Bean Validation API with annotations like NotNull, NotBlank, Size, Min, Max, Email, and Pattern applied to the fields of request DTO classes. The Valid annotation on the RequestBody parameter in the controller method triggers validation before the method executes. If validation fails, Spring automatically throws a MethodArgumentNotValidException which can be caught in the global exception handler to return a structured 400 Bad Request response with details about which fields failed validation and why.
DTO stands for Data Transfer Object and is a simple class used to carry data between layers of an application or between the client and server. In REST APIs, DTOs are used to separate the internal domain model from the API response structure. This is important for security, because it prevents accidentally exposing sensitive fields that exist on entity classes. It is also important for API design, because the structure clients receive does not need to mirror the database structure exactly. Common libraries like MapStruct and ModelMapper automate the mapping between entity classes and DTOs to reduce boilerplate code.
Both annotations map HTTP GET requests to handler methods. GetMapping is a composed annotation introduced in Spring 4.3 that is shorthand for RequestMapping with the method attribute set to RequestMethod.GET. Similarly, PostMapping, PutMapping, PatchMapping, and DeleteMapping are shorthand annotations for their respective HTTP methods. The composed annotations are preferred in modern Spring Boot development because they are more concise and make the intent of each endpoint immediately clear from the annotation alone.
Pagination in Spring Boot is implemented using Spring Data's Pageable interface. The controller method accepts a Pageable parameter which Spring automatically populates from query parameters like page and size in the request URL. The repository method accepts the Pageable parameter and returns a Page object containing the requested slice of data along with pagination metadata including total elements, total pages, and current page number. This metadata is included in the API response so clients can implement navigation controls. Custom sort orders can also be specified through the sort query parameter.
Filtering and searching are typically implemented through query parameters in the URL. In Spring Boot, RequestParam annotations in the controller method capture these parameters and pass them to the service layer. For simple filtering, Spring Data JPA method naming conventions can generate queries automatically. For complex, dynamic filtering with multiple optional parameters, the Specification API from Spring Data JPA or QueryDSL provides a type-safe way to build queries programmatically based on which filter parameters are present. For full-text search requirements, integration with Elasticsearch through Spring Data Elasticsearch is a common approach in enterprise Java applications.
Spring Boot Actuator provides production-ready features for monitoring and managing a Spring Boot application through built-in REST endpoints. Key Actuator endpoints include /actuator/health which reports application health status, /actuator/metrics which provides application performance metrics, /actuator/info which displays application information, /actuator/env which shows environment properties, and /actuator/mappings which lists all available REST API endpoints. Actuator is relevant to REST API development for monitoring API health, tracking response times, and diagnosing production issues. In production environments, Actuator endpoints should be secured to prevent unauthorized access to sensitive operational information.
Jackson is a Java library for serializing Java objects to JSON and deserializing JSON to Java objects. Spring Boot auto-configures Jackson as the default message converter for REST controllers, meaning all RestController methods that return Java objects automatically produce JSON responses without any additional configuration. Jackson annotations like JsonProperty for custom field names, JsonIgnore for excluding fields from serialization, JsonFormat for date formatting, and JsonInclude for controlling which fields are included in the output are commonly used in DTO classes to control the exact shape of API responses.
API versioning is the practice of managing changes to a REST API in a way that does not break existing clients. The three most common versioning strategies are URL versioning where the version is included in the path such as /api/v1/users, which is the most visible and widely used approach in Java REST APIs. Header versioning where the client specifies the version in a custom request header, which keeps URLs clean but is less discoverable. And query parameter versioning where the version is passed as a query parameter such as /api/users?version=1. URL versioning is the most commonly implemented strategy in Spring Boot applications because of its simplicity and visibility.
JWT authentication in Spring Boot involves several components working together. A login endpoint accepts user credentials and returns a signed JWT containing the user's ID and roles if authentication succeeds. A JWT utility class handles token generation, validation, and claim extraction using a library like jjwt. A custom OncePerRequestFilter subclass intercepts every request, extracts the token from the Authorization header, validates it, and sets the authentication in the Spring Security context if valid. Spring Security configuration specifies which endpoints require authentication and which are publicly accessible, and configures the custom filter in the security filter chain before the standard UsernamePasswordAuthenticationFilter.
OAuth2 is an authorization framework that allows a user to grant a third-party application limited access to their account on another service without sharing their password. It defines flows for obtaining access tokens through authorization servers. JWT is a token format, not a protocol. OAuth2 can use JWT as the format for its access tokens. In Spring Boot, Spring Security OAuth2 Resource Server support allows APIs to validate JWT tokens issued by an OAuth2 authorization server like Keycloak, Auth0, or Okta. The key distinction is that OAuth2 defines how tokens are obtained and managed while JWT defines the structure and signing of the token itself.
Rate limiting restricts the number of requests a client can make to an API within a specified time window to prevent abuse, protect against denial of service attacks, and ensure fair usage across clients. In Spring Boot, rate limiting can be implemented using libraries like Resilience4j which provides a RateLimiter module, Bucket4j which implements the token bucket algorithm, or through API gateways like Spring Cloud Gateway or Kong that handle rate limiting at the infrastructure level before requests reach the application. Rate limit violations are typically communicated to clients with a 429 Too Many Requests status code along with a Retry-After header indicating when the client can retry.
CORS stands for Cross-Origin Resource Sharing and is a browser security mechanism that blocks web pages from making requests to a different domain than the one that served the page. In a full stack application where a React or Angular frontend on one domain calls a Spring Boot API on another, CORS must be explicitly configured on the backend to allow these cross-origin requests. In Spring Boot, CORS can be configured at the method level using the CrossOrigin annotation, at the controller level, or globally through a WebMvcConfigurer bean that defines allowed origins, HTTP methods, headers, and whether credentials like cookies are permitted.
API documentation describes the available endpoints, request parameters, request bodies, response structures, and authentication requirements of a REST API so that other developers can consume it correctly. Swagger and OpenAPI are the industry standard tools for API documentation in Java. Springdoc-openapi is the most commonly used library for generating OpenAPI 3.0 documentation automatically from Spring Boot REST controller annotations. It generates an interactive Swagger UI accessible through a browser where developers can explore and test API endpoints without writing any code. Proper API documentation is considered a professional standard and is assessed in technical interviews for senior developer roles.
Optimistic locking assumes conflicts are rare and allows multiple clients to read a resource simultaneously. When a client attempts to update a resource, the system checks whether the resource has been modified since the client last read it using a version number or timestamp. If it has been modified, the update is rejected with a 409 Conflict response and the client must re-read the resource and retry. Pessimistic locking prevents concurrent access by locking the resource when it is read, ensuring no other client can modify it until the lock is released. Optimistic locking is preferred for REST APIs because it is stateless and scales better, while pessimistic locking can cause performance bottlenecks in high-concurrency environments.
REST API security best practices include always using HTTPS to encrypt data in transit and never exposing APIs over plain HTTP. Implementing authentication on all non-public endpoints using JWT or OAuth2. Validating and sanitizing all input to prevent injection attacks. Returning minimal error information in production responses to avoid leaking implementation details. Implementing rate limiting to prevent brute force and denial of service attacks. Using CORS restrictions to limit which domains can call the API. Implementing proper authorization checks to ensure users can only access resources they own or are permitted to access. Logging all API access for audit and monitoring purposes. And regularly scanning API endpoints for known vulnerabilities using security testing tools.
The OPTIONS method is used by browsers as part of the CORS preflight mechanism to determine what HTTP methods and headers are permitted by the server before sending the actual cross-origin request. When a browser detects that a request would be cross-origin, it first sends an OPTIONS request to the API. The server responds with the CORS headers indicating the allowed origins, methods, and headers. If the response indicates the actual request is allowed, the browser proceeds with it. Spring Boot handles OPTIONS preflight requests automatically as part of its CORS configuration without requiring explicit endpoint definitions.
REST API testing in Spring Boot is conducted at multiple levels. Unit tests use Mockito to mock dependencies and test service layer business logic in isolation. Integration tests use MockMvc, which is provided by the Spring Test framework, to simulate HTTP requests to controller endpoints and assert response status codes, headers, and body content without starting a full HTTP server. End-to-end tests use RestTemplate or WebTestClient to send actual HTTP requests to a running application server. Tools like Postman and Insomnia are used for manual API testing during development. Automated API contract testing with tools like Spring Cloud Contract ensures that API changes do not break downstream consumers.
MockMvc is a testing framework that simulates HTTP requests to Spring MVC controllers in a test context without starting an actual HTTP server. It provides fast, lightweight integration tests that test the full Spring MVC stack including request mapping, validation, exception handling, and serialization. RestTemplate is an HTTP client that sends real HTTP requests to a running server. It is used for integration tests that require a fully running application or for testing against external APIs. WebTestClient is the modern reactive alternative to RestTemplate for testing both reactive and non-reactive Spring Boot applications and is preferred in new projects.
Swagger UI is an interactive web interface generated from an OpenAPI specification document that allows developers to explore, understand, and test REST API endpoints directly in a browser without writing any client code. In Spring Boot, integrating the springdoc-openapi library automatically generates the OpenAPI specification from controller annotations and provides a Swagger UI accessible at /swagger-ui.html. The UI displays all available endpoints, their parameters, request body schemas, response schemas, and authentication requirements. Developers can send test requests directly from the UI and inspect the responses, making it an invaluable tool for development, debugging, and onboarding new team members to an API.
An API gateway is a single entry point for all client requests to a microservices system. It receives requests from clients, routes them to the appropriate microservices, and aggregates responses when needed. Beyond routing, API gateways handle cross-cutting concerns like authentication and authorization, rate limiting, logging, SSL termination, and request transformation. In Java microservices architectures, Spring Cloud Gateway is the standard tool for implementing an API gateway. The pattern simplifies client code by providing a unified interface, reduces the number of network calls for complex operations through response aggregation, and centralizes security enforcement.
An idempotency key is a unique identifier provided by the client in a request header that allows the server to recognize and deduplicate repeated requests. When a client sends a POST request to create a resource and does not receive a response due to a network failure, it cannot know whether the request was processed. If it retries without an idempotency key, it may create duplicate resources. With an idempotency key, the server stores the result of the first request associated with the key and returns the same result for any subsequent requests with the same key, preventing duplicates. This pattern is widely used in payment APIs and financial transaction endpoints where duplicate operations have serious consequences.
Best practices for REST API response design include using consistent response structures across all endpoints so clients can write generic error handling code. Always returning appropriate HTTP status codes that reflect the actual outcome of the request. Including pagination metadata in list responses so clients know the total number of results and how to request additional pages. Providing meaningful error messages with error codes in error responses without exposing stack traces or internal implementation details. Using ISO 8601 format for all date and time fields to ensure consistent parsing across different client platforms. Including resource identifiers in creation responses so clients know the ID of the newly created resource. And versioning responses consistently to support API evolution without breaking existing clients.
Reading about REST concepts is valuable but being able to build a complete, working REST API from scratch is what technical interviews actually assess. Practice building Spring Boot REST APIs that include all the components discussed in this blog: a layered architecture with controller, service, and repository layers, proper request validation, global exception handling, JWT authentication, pagination, and Swagger documentation. Completing two or three such projects gives you concrete examples to reference when answering applied questions in interviews.
Interviewers for Java REST API roles do not just ask what things are. They ask why certain approaches are used, what problems they solve, and what the tradeoffs are between alternatives. For example, why use JWT over session-based authentication. Why use DTOs instead of exposing entity classes directly. Why return ResponseEntity instead of plain objects. Preparing answers that explain the reasoning behind design decisions demonstrates the depth of understanding that separates strong candidates from average ones.
REST API development for Java involves multiple interconnected technologies including Spring Boot, Spring Security, JPA, Jackson, and testing frameworks. Building a coherent understanding of how these work together through self-directed study is significantly harder and slower than learning through a structured program with live instruction and real project work. The best Java course in Mumbai and the best interactive online Java training programs are designed to build this integrated understanding through a guided curriculum and hands-on project assignments that mirror real enterprise development work.
JustAcademy's Java training programs cover Core Java foundations and advanced Spring Boot REST API development within a comprehensive curriculum that includes real-world projects, live doubt resolution, and placement support tailored to the Indian job market in 2026.
For professionals and freshers in Maharashtra who prefer classroom-based learning with local industry connections, Core Java Training in Mumbai and Advance Java Training in Mumbai are widely recognized as the best Java courses in Mumbai for building both foundational and advanced REST API development skills. For learners anywhere in India or globally, Core Java Online Training and Advance Java Online Training deliver the same live interactive curriculum with placement support from any location.
For full stack developers who want to strengthen their frontend REST API consumption skills alongside their Java backend knowledge, JustAcademy also offers:
Building skills across adjacent technology areas makes you a more versatile and competitive Java developer. Explore these programs at JustAcademy:
REST API interview questions for Java developers cover a broad range of topics from fundamental HTTP concepts and REST principles to Spring Boot implementation details, security mechanisms, versioning strategies, and API design best practices. The forty questions covered in this blog represent the full spectrum of what interviewers assess across fresher, mid-level, and senior Java developer roles in India in 2026.
Strong REST API knowledge is not built through memorization alone. It comes from building real APIs, debugging real problems, making real design decisions, and understanding the reasoning behind best practices. The candidates who perform best in REST API interviews are those who can speak from practical experience, explain their design choices, and demonstrate awareness of the tradeoffs between different approaches.
The fastest path to that level of preparation is through a structured training program that teaches REST API development within the full context of a Java backend stack, includes live project work, and prepares you specifically for the types of questions and coding tasks that interviews in 2026 include.
For learners in Maharashtra who want the best Java REST API training in Mumbai with classroom-based learning and direct access to the Mumbai tech hiring market, Core Java Training in Mumbai and Advance Java Training in Mumbai are the programs built for exactly that outcome. For learners across India and globally who want live interactive Java training from any location, Core Java Online Training and Advance Java Online Training deliver the same curriculum depth and placement support with full schedule flexibility.
Register for a Free Demo to experience the training firsthand and speak with an advisor about your Java REST API career goals, or Download the Brochure to review full course details, batch schedules, and fees before you commit.
Selenium WebDriver Interview Questions and Answers for Freshers and Experienced Testers in 2026
UI UX Interview Questions and Answers for Freshers and Beginners Covering Design Thinking, Figma, Wireframing, and UX Research in 2026
Figma Interview Questions and Answers for UI UX Designers, Freshers, and Experienced Designers in 2026
SQL, ORM, and Database Interview Questions and Answers for Python Backend Developers and Freshers in
OOP Concepts, Python Classes Interview Questions and Answers for Beginners and Freshers in 2026
REST API, FastAPI, and Django REST Framework Interview Questions and Answers for Python Freshers and Developers in 2026
Flask API, Python Backend Interview Questions and Answers for Beginners and Freshers in 2026
Django Interview, Python Backend Questions and Answers for Freshers and Beginners in 2026
Python DSA, Coding Interview Questions and Answers for Freshers and Beginners in 2026
Version Control, GitHub Interview Questions and Answers for Python Developers and Freshers in 2026
