Mid-LevelAPI & Integration Testing
How do you test API rate limiting and throttling?
- rate limiting
- throttling
- load testing
Answer it first, then compare. Nothing here is saved or scored.
Model answer
Send requests at the documented rate limit boundary, verify that the Nth+1 request returns 429 (Too Many Requests) with a Retry-After header. Test reset behavior - after the window expires, requests should succeed again. Verify rate limit headers in responses (X-RateLimit-Limit, X-RateLimit-Remaining). Test across different API keys and IP addresses. Use tools like k6 or Artillery for load-based rate limit testing.
What interviewers listen for
- Schema-first thinkingYou validate response shape before you assert on values, every time.
- Status-code literacyYou can defend why 401 vs 403 vs 422 matters for the consumer.
- Contract awarenessYou know when consumer-driven contract tests beat end-to-end checks.
- Auth fluencyYou can describe rotating tokens across parallel workers without secrets in logs.