API Concepts: Requests, Responses, Headers, Parameters & Payloads

API Request and Response

An API Request is a message sent by the client to the server asking it to perform an action or return some data.

An API Response is the message returned by the server after processing the request. It contains the status code, response headers, and response body.

Every API communication follows this request-response cycle.

API Communication Flow

Client
   │
   │  HTTP Request
   ▼
Server
   │
   │  HTTP Response
   ▼
Client

Components of an API Request

An API request typically contains:

• URL (Endpoint)
• HTTP Method
• Headers
• Query Parameters (Optional)
• Path Parameters (Optional)
• Request Body / Payload (Optional)

Components of an API Response

An API response typically contains:

• HTTP Status Code
• Response Headers
• Response Body
• Response Time

Example Request

POST https://api.example.com/users

Headers

Content-Type: application/json
Authorization: Bearer eyJhbGc...

Request Body

{
  "name": "John",
  "email": "john@test.com"
}

Example Response

Status Code

201 Created

Response Body

{
  "id": 101,
  "name": "John",
  "email": "john@test.com"
}

Interview Answer

"An API request is a message sent from the client to the server requesting an action or resource. It contains the URL, HTTP method, headers, and sometimes a request body. An API response is the server's reply containing a status code, response headers, and a response body. For example, when creating a user using a POST request, the server typically returns 201 Created along with the newly created user details."

API Request Lifecycle

Client Sends Request
        │
        ▼
Server Receives Request
        │
        ▼
Business Logic Executes
        │
        ▼
Database Processing
        │
        ▼
Server Generates Response
        │
        ▼
Client Receives Response

Request Headers vs Response Headers

Headers are key-value pairs that carry additional information about the HTTP request or response.

They are not part of the request or response body.

Request Headers

Request headers are sent from the client to the server.

They tell the server how to process the request.

Common request headers include:

• Content-Type
• Authorization
• Accept
• User-Agent
• Accept-Language

Example Request Header

Content-Type: application/json
Authorization: Bearer eyJhbGc...
Accept: application/json

Response Headers

Response headers are sent from the server to the client.

They provide information about the returned response.

Common response headers include:

• Content-Type
• Cache-Control
• Content-Length
• Server
• Date
• Set-Cookie

Example Response Header

Content-Type: application/json
Cache-Control: no-cache
Content-Length: 245

Request Headers vs Response Headers

REST Assured Example

Sending request headers:

given()
        .header("Authorization", "Bearer " + token)
        .header("Content-Type", "application/json")

.when()
        .post("/users");

Validating response headers:

response.then()
        .header("Content-Type", "application/json");

Interview Answer

"Request headers are sent from the client to the server and provide information such as authentication and content type. Response headers are returned by the server and provide information such as content type, caching details, and server information. In REST Assured, I send headers using .header() and validate response headers using .header() assertions."

Query Parameters vs Path Parameters

REST APIs commonly use Path Parameters and Query Parameters.

Although both appear in the URL, they serve different purposes.

Path Parameters

A path parameter identifies a specific resource.

It is part of the URL path.

Example

/users/101

Here,

101

is the path parameter.

It identifies a specific user.

REST Assured Example

given()
        .pathParam("id", 101)

.when()
        .get("/users/{id}");

Query Parameters

Query parameters provide additional information such as:

• Search
• Filter
• Sorting
• Pagination

They appear after the ? symbol.

Example

/products?category=electronics&sort=price

Query Parameters:

• category
• sort

REST Assured Example

given()
        .queryParam("category", "electronics")
        .queryParam("sort", "price")

.when()
        .get("/products");

Path Parameter vs Query Parameter

Real-Time Example

Retrieve a specific employee:

/employees/1001

Retrieve employees from Hyderabad:

/employees?city=Hyderabad

Interview Answer

"A path parameter identifies a specific resource and forms part of the URL, for example /users/101. A query parameter provides additional information such as filtering, sorting, or searching, for example /products?category=electronics. In REST Assured, I use .pathParam() for path parameters and .queryParam() for query parameters."

What is an Endpoint?

An endpoint is the URL through which a client accesses a specific API resource or performs an operation.

Every API exposes one or more endpoints.

Think of an endpoint as the exact address of a resource.

Examples

Retrieve all users

/users

Retrieve user 101

/users/101

Create a user

/users

Delete user 101

/users/101

REST Assured Example

given()

.when()
        .get("/users/101");

Interview Answer

"An endpoint is the URL through which a client accesses a specific API resource. For example, /users/101 is an endpoint used to retrieve the details of user 101. In REST Assured, the endpoint is passed to methods like .get(), .post(), .put(), or .delete()."

What is a Payload?

A payload is the actual data sent in the request body.

Payloads are commonly used with:

• POST
• PUT
• PATCH

operations.

Sample Payload

{
  "name": "John",
  "email": "john@test.com",
  "age": 28
}

REST Assured Example

given()
        .body(payload)

.when()
        .post("/users");

Why Payloads Are Used

Payloads are used to:

• Create resources
• Update resources
• Send complex data
• Transfer business information

Interview Answer

"A payload is the data sent in the body of an HTTP request, typically with POST, PUT, or PATCH methods. It is used to create or update resources. In REST Assured, I send the payload using the .body() method."

HTTP Status Codes

An HTTP Status Code is a 3-digit number returned by the server indicating the outcome of the request.

The first digit categorizes the response.

HTTP Status Code Categories

Common HTTP Status Codes

Why Status Codes Are Important

During API automation, every test should verify the expected status code.

Examples:

• Successful GET → 200
• Successful POST → 201
• Unauthorized request → 401
• Invalid request → 400
• Missing resource → 404

REST Assured Example

response.then()
        .statusCode(201);

Interview Answer

"HTTP status codes indicate whether an API request was successful or failed. They are grouped into five categories: informational (1xx), success (2xx), redirection (3xx), client errors (4xx), and server errors (5xx). Validating the correct status code is one of the most important checks in API automation."

API Rate Limiting

API Rate Limiting controls how many requests a client can make within a specified time period.

It protects APIs from:

• Server overload
• Abuse
• DDoS attacks
• Excessive traffic

Example

Suppose an API allows:

100 Requests / Minute

If the client sends:

120 Requests

within one minute,

the server typically responds with:

429 Too Many Requests

Rate Limiting Flow

Client Sends Requests
          │
          ▼
Within Allowed Limit?
     │             │
     ▼             ▼
Yes               No
│                 │
▼                 ▼
200 OK      429 Too Many Requests

Common Rate Limiting Headers

Many APIs include headers such as:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 25
Retry-After: 60

These indicate:

• Maximum allowed requests
• Remaining requests
• Time to wait before retrying

Why Test Rate Limiting?

API automation should verify that:

• Limits are enforced correctly
• Correct status code (429) is returned
• Appropriate error message is returned
• Rate-limit headers are present
• The API recovers correctly after the waiting period

Interview Answer

"API rate limiting restricts the number of requests a client can send within a specific time window. It protects the server from excessive traffic and abuse. When the limit is exceeded, the API usually returns 429 Too Many Requests. During API testing, I verify that the rate limit is enforced correctly, the expected status code is returned, and the appropriate rate-limit headers are included in the response."

Best Practices

• Validate both request and response headers.
• Always verify HTTP status codes.
• Use path parameters for identifying resources.
• Use query parameters for filtering and searching.
• Keep payloads clean and valid.
• Validate both successful and error responses.
• Test API rate limiting where applicable.
• Log request and response details for easier debugging.

Frequently Asked Questions (FAQs)

1. What is an API request and response?

An API request is a message sent by the client to the server containing the URL, HTTP method, headers, and optionally a request body. An API response is the server's reply containing the HTTP status code, response headers, and response body.

2. What is the difference between request headers and response headers?

Request headers are sent from the client to the server and describe how the request should be processed (for example, Content-Type and Authorization). Response headers are sent by the server to the client and describe the returned response (for example, Content-Type, Cache-Control, and Content-Length).

3. What is the difference between query parameters and path parameters?

A path parameter identifies a specific resource and is part of the URL path (for example, /users/123). A query parameter provides additional information such as filtering, sorting, searching, or pagination and appears after the ? symbol (for example, /products?category=electronics&sort=price).

4. What is an endpoint?

An endpoint is the URL through which a client accesses a specific API resource or performs an operation. Examples include /users, /users/101, and /orders/5001.

5. What is a payload?

A payload is the data sent in the request body, typically with POST, PUT, or PATCH requests to create or update resources. In REST Assured, payloads are sent using the .body() method.

6. What is API rate limiting?

API rate limiting restricts the number of requests a client can make within a specific time window. If the allowed limit is exceeded, the API typically responds with 429 Too Many Requests to protect the server from overload and misuse.