HTTP & APIs interview questions

What is the difference between 401 and 403?

401 means the request was not authenticated, so the credentials are missing or invalid. 403 means authentication succeeded but the caller is not permitted to do this. One is a credentials problem, the other a permissions problem.

Which HTTP errors should you retry?

429 after a backoff, and 5xx and network timeouts, which are often transient. Not 4xx generally, because an identical request will fail identically, so retrying wastes time and money.

What is idempotency and why does it matter for API calls?

An idempotent request has the same effect whether it runs once or several times. It matters because a timeout does not tell you whether the server acted, so a retry can duplicate the action. An idempotency key lets the server recognise the repeat and return the original result.

Why add jitter to exponential backoff?

Without it, all clients that failed at the same moment retry at the same moment, producing a synchronised spike that can knock over the recovering service again. Randomness spreads the retries out.

You are calling an API 1000 times and keep hitting rate limits. What do you do?

Cap concurrency with a semaphore rather than firing everything at once, read the rate limit headers and slow down before being rejected, back off exponentially with jitter and honour retry_after, and use batch endpoints for anything that can wait.

What does a timeout tell you about whether the server acted?

Nothing. The request may have been processed while the connection dropped. That is why any retry of a state-changing call needs an idempotency key, or you risk doing it twice.