HTTP and REST: the contract between client and server

Every backend interview starts here. If you can explain a request end to end, you're ahead of most candidates.

Anatomy of an HTTP request

POST /api/jobs/42/applications HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOi...
Content-Type: application/json

{ "coverNote": "I built a similar dashboard for my college fest." }

A response has a status code, headers and an optional body:

HTTP/1.1 201 Created
Location: /api/applications/981
Content-Type: application/json

{ "id": 981, "status": "submitted" }

Methods and their meaning

Idempotent means doing it twice has the same effect as once. That matters for retries: a client can safely retry a PUT or DELETE after a timeout, but a retried POST might create two orders. Use an idempotency key for payments.

Status codes to know

• 2xx success: 200 OK, 201 Created, 204 No Content.
• 3xx redirect: 301 permanent, 302/307 temporary, 304 not modified (caching).
• 4xx client error: 400 bad input, 401 not authenticated, 403 authenticated but not allowed, 404 not found, 409 conflict (duplicate), 422 validation failed, 429 too many requests.
• 5xx server error: 500 bug, 502 bad gateway, 503 unavailable, 504 gateway timeout.

REST design rules

• Resources are nouns, plural: /jobs, /jobs/42, /jobs/42/applications.
• The method says the action: DELETE /jobs/42, not POST /deleteJob.
• Filtering, sorting and pagination in the query string: /jobs?city=pune&sort=-createdAt&page=2&limit=20.
• Return consistent error shapes: { "error": { "code": "VALIDATION", "message": "Email is required", "field": "email" } }.
• Version the API when you make breaking changes: /v1/jobs or a header.

Pagination

• Offset (?page=3&limit=20 → OFFSET 40) is simple but slow on big tables and shifts when rows are added.
• Cursor/keyset (?after=2026-10-01T10:00:00Z_981) uses an indexed column: fast and stable for feeds.

REST vs GraphQL vs gRPC (short answer)

• REST: simple, cacheable, the default for public APIs.
• GraphQL: one endpoint; the client asks for exactly the fields it needs. Good for complex UIs with many related resources; harder to cache and secure.
• gRPC: binary, fast, typed contracts; used between internal microservices.

Check yourself

• What's the difference between 401 and 403?
• Why does idempotency matter for retries?
• Design the endpoints for "users apply to jobs, companies shortlist applications".