Top 50 RestAssured Interview Questions for QA / SDET (With Answers)

RestAssured is the go-to Java library for testing REST APIs, and it shows up in almost every QA Automation / SDET interview. This guide covers the 50 questions you're most likely to be asked, from the basics to advanced topics like authentication, filters, and framework design.

Section 1: Fundamentals

1. What is RestAssured?

RestAssured is an open-source Java library used to test REST APIs. It provides a domain-specific language (DSL) that lets you write API tests in a simple, readable Given-When-Then style, similar to BDD frameworks like Cucumber.

2. Why use RestAssured instead of plain Java HTTP clients?

Plain HTTP clients (like HttpURLConnection or HttpClient) require a lot of boilerplate code to build requests, send them, and parse responses. RestAssured abstracts all of that away, offering built-in JSON/XML parsing, easy assertions, authentication support, and a fluent syntax — drastically reducing code and improving readability.

3. What are the core dependencies needed to set up RestAssured in a Maven project?

You need the rest-assured dependency from io.rest-assured, and typically a JSON parsing/assertion library like json-path and json-schema-validator (also from the same group), along with JUnit or TestNG for test execution and Hamcrest for matchers.

4. What is the Given-When-Then syntax in RestAssured?

It's RestAssured's core structure for writing tests:

Given – set up preconditions (headers, params, body, auth)
When – specify the HTTP action (GET, POST, PUT, DELETE, etc.)
Then – validate the response (status code, body, headers)

5. What is the difference between `RestAssured.given()` and creating a `RequestSpecification` object separately?

given() starts an inline request chain for a single test. A RequestSpecification object lets you predefine common configuration (base URI, headers, auth) once and reuse it across multiple tests, reducing duplication.

6. What is a RequestSpecification?

It's an interface used to define reusable request configuration — base URI, base path, headers, query params, content type, and authentication — that can be shared across multiple test methods or classes.

7. What is a ResponseSpecification?

Similar to RequestSpecification, but for expected response validation. It lets you predefine expected status codes, response time limits, or headers that should apply across multiple tests.

8. How do you set a base URI globally in RestAssured?

RestAssured.baseURI = "https://api.example.com";

This applies to all requests in the test suite unless overridden.

9. What's the difference between `baseURI`, `basePath`, and `port` in RestAssured?

baseURI – the root URL (e.g., https://api.example.com)
basePath – a common path segment appended to every request (e.g., /v1)
port – the port number, if not part of the URI (e.g., 8080)

10. How do you print/log request and response details in RestAssured?

Using logging methods like:

given().log().all()  // logs request
...
.then().log().all(); // logs response

You can also use .log().body(), .log().headers(), or .log().ifValidationFails() for more targeted logging.

Section 2: Requests and HTTP Methods

11. How do you send a GET request in RestAssured?

given().baseUri("https://api.example.com")
       .when().get("/users")
       .then().statusCode(200);

12. How do you send a POST request with a JSON body?

given().contentType("application/json")
       .body("{ \"name\": \"John\" }")
       .when().post("/users")
       .then().statusCode(201);

13. How do you send query parameters and path parameters?

Query parameters use .queryParam("key", "value"), while path parameters use .pathParam("key", "value") combined with a placeholder in the URL, e.g., .get("/users/{id}").

14. What is the difference between query parameters and form parameters?

Query parameters are appended to the URL (?key=value) and typically used in GET requests. Form parameters are sent in the request body as application/x-www-form-urlencoded data, commonly used in POST requests simulating HTML form submissions, set via .formParam().

15. How do you send headers in a request?

given().header("Authorization", "Bearer <token>")
       .header("Accept", "application/json")

Multiple headers can also be passed as a Map using .headers(map).

16. How do you send a request body using a POJO (Plain Old Java Object)?

RestAssured can serialize a POJO directly if a JSON serializer (like Jackson or Gson) is on the classpath:

User user = new User("John", 25);
given().contentType(ContentType.JSON)
       .body(user)
       .post("/users");

17. How do you send multipart/form-data requests (e.g., file uploads)?

given().multiPart("file", new File("test.png"))
       .when().post("/upload");

18. How do you handle PUT, PATCH, and DELETE requests?

Same DSL pattern, just swap the HTTP method:

.when().put("/users/1");
.when().patch("/users/1");
.when().delete("/users/1");

19. How can you set a custom content type?

given().contentType("application/xml")

Or use the ContentType enum: ContentType.JSON, ContentType.XML, ContentType.TEXT, etc.

20. How do you send cookies in a request?

given().cookie("session_id", "abc123")

Multiple cookies can be passed using a Map with .cookies(map).

Section 3: Response Handling and Validation

21. How do you validate the status code of a response?

.then().statusCode(200);

You can also use Hamcrest matchers: .statusCode(equalTo(200)) or ranges like .statusCode(is(oneOf(200, 201))).

22. How do you extract a value from a JSON response?

Using JsonPath:

String name = response.jsonPath().getString("data.name");

23. What is JsonPath in RestAssured?

JsonPath is a library integrated with RestAssured that lets you query and extract values from a JSON response using a dot/bracket path syntax, similar to XPath for XML.

24. How do you validate response body content using Hamcrest matchers?

.then().body("name", equalTo("John"))
       .body("age", greaterThan(18));

25. How do you validate an array/list in the response body?

.then().body("users.size()", equalTo(3))
       .body("users[0].name", equalTo("John"));

You can also use hasItem() or hasItems() for unordered validation.

26. How do you validate response headers?

.then().header("Content-Type", equalTo("application/json; charset=utf-8"));

27. How do you validate response time (SLA validation)?

.then().time(lessThan(2000L));

This checks that the response was returned within a given time in milliseconds.

28. How do you extract the entire response as a String or Object?

Response response = given().when().get("/users");
String body = response.getBody().asString();

You can also deserialize it into a POJO using response.as(User.class).

29. What is the difference between `extract().response()` and `extract().body()`?

extract().response() returns the full Response object (status, headers, body, cookies). extract().body() returns only the response body content, typically used when you only need to parse the payload.

30. How do you perform JSON schema validation in RestAssured?

Using the json-schema-validator dependency:

.then().assertThat().body(matchesJsonSchemaInClasspath("schema.json"));

This ensures the response structure matches a predefined JSON schema — useful for contract testing.

Section 4: Authentication and Security

31. What types of authentication does RestAssured support?

Basic Auth, Digest Auth, OAuth1, OAuth2, Form Auth, and custom header-based token authentication (e.g., Bearer tokens).

32. How do you implement Basic Authentication?

given().auth().preemptive().basic("username", "password")

preemptive() sends credentials with the initial request instead of waiting for a 401 challenge.

33. How do you implement Bearer Token / OAuth2 authentication?

given().auth().oauth2("your_token_here")

Alternatively, tokens are often just passed manually as headers: .header("Authorization", "Bearer " + token).

34. How do you handle CSRF tokens or session-based authentication in RestAssured?

Typically, you first send a login request, extract the session cookie or CSRF token from the response, and then pass it along with subsequent requests using .cookie() or .header().

35. How do you disable SSL certificate validation in RestAssured (for testing environments)?

RestAssured.useRelaxedHTTPSValidation();

This should only be used in test/staging environments, never in production test suites, since it bypasses certificate checks.

Section 5: Advanced Features

36. What are Filters in RestAssured?

Filters allow you to intercept and modify requests/responses before they're sent or after they're received. They're useful for logging, adding common headers, or implementing custom authentication logic. Example: RequestLoggingFilter, ResponseLoggingFilter, or custom classes implementing the Filter interface.

37. How do you implement a custom Filter?

public class CustomFilter implements Filter {
    public Response filter(FilterableRequestSpecification req,
                            FilterableResponseSpecification res,
                            FilterContext ctx) {
        // custom logic before/after request
        return ctx.next(req, res);
    }
}

38. How do you handle dynamic/data-driven testing in RestAssured?

Typically combined with TestNG's @DataProvider or JUnit's parameterized tests, often feeding data from CSV, Excel, or JSON files to run the same test logic against multiple data sets.

39. How do you chain multiple API calls where one response feeds into the next request?

Extract the required value from the first response using JsonPath, then pass it as a parameter/body value in the next request — commonly needed for flows like "create resource → use returned ID → fetch/update/delete that resource."

40. How do you handle API response pagination in tests?

By reading pagination metadata from the response (like page, totalPages, nextPageUrl), and looping requests until all pages are validated, or asserting the specific pagination fields are correct.

41. How can you validate XML responses in RestAssured?

Using XmlPath or Hamcrest's hasXPath():

.then().body(hasXPath("//user/name", equalTo("John")));

42. What is the difference between RestAssured and Postman for API testing?

Postman is a GUI-based tool ideal for manual/exploratory testing and quick collection sharing. RestAssured is a code-based library meant for automated testing integrated into CI/CD pipelines, version control, and combined with assertions/reporting frameworks — better suited for scalable regression suites.

43. How do you integrate RestAssured with TestNG or JUnit?

RestAssured is just a library — you write your API calls and assertions inside standard @Test methods in TestNG or JUnit. TestNG additionally offers useful features like @BeforeClass for setup (e.g., setting baseURI), grouping, and data providers.

44. How do you generate reports for RestAssured API tests?

By integrating with reporting libraries like Extent Reports, Allure, or TestNG's built-in HTML reports. Logs and request/response details can be attached to the report for better debugging.

45. How would you structure a RestAssured framework for a real project?

A typical structure includes:

Base/Config layer – base URI, environment configs
POJO/model classes – for request/response serialization
Request builders / utility classes – reusable request specs
Test classes – actual test logic and assertions
Test data layer – JSON/CSV/Excel files or data providers
Reporting & CI integration – Extent/Allure reports, Jenkins/GitHub Actions pipeline

46. How do you handle environment-specific configurations (dev, QA, staging, prod)?

Using property files (.properties or .yaml) per environment, loaded dynamically at runtime based on a system property or Maven profile, so baseURI and other configs switch automatically without code changes.

47. How do you test negative scenarios (invalid inputs, unauthorized access, etc.) using RestAssured?

By sending intentionally invalid data, missing required fields, invalid tokens, or wrong HTTP methods, then asserting the correct error status codes (400, 401, 403, 404, 500) and validating meaningful error messages in the response body.

48. Can RestAssured be used for performance/load testing?

No — RestAssured is designed for functional API testing, not load testing. For performance testing, tools like JMeter, Gatling, or k6 are more appropriate, though RestAssured tests are sometimes reused as a base for building load scripts.

49. How do you handle flaky API tests in RestAssured (e.g., intermittent failures)?

Common strategies include adding retry logic (via TestNG's IRetryAnalyzer or custom retry wrappers), avoiding hard-coded waits in favor of polling/conditional checks, ensuring test data isolation, and investigating whether flakiness stems from environment instability rather than the test itself.

50. What are some best practices for writing maintainable RestAssured tests?

Keep request specifications reusable and centralized (avoid duplicating headers/auth logic)
Use POJOs instead of raw JSON strings for request/response bodies
Separate test data from test logic
Use meaningful assertions with clear failure messages
Avoid hard-coded environment values — externalize configuration
Log requests/responses only on failure to keep logs clean
Group and tag tests (smoke, regression, sanity) for flexible execution in CI/CD

Final Tips for the Interview

Interviewers often care less about memorized syntax and more about whether you understand why RestAssured is structured the way it is, and how you'd apply it in a real framework. Be ready to:

Walk through a sample framework you've built or would build
Explain a tricky bug you debugged using request/response logging
Discuss how you handle authentication tokens across a test suite
Talk about how API tests fit into your team's CI/CD pipeline

Good luck with your interview!

Playwright Tutorial

Java Tutorial

Selenium Tutorial

Rest Assured Tutorial

SQL Tutorial

Git Tutorial

CI / CD Tutorial

Interview Questions