ASP.NET Web API (.NET Framework) Interview Questions

A framework on .NET Framework for building HTTP services. Controllers derive from ApiController, routing is configured in WebApiConfig, and it is typically hosted on IIS.

An interface returned from actions that represents an HTTP response, with helpers such as Ok(), NotFound(), BadRequest() and Created(). It makes actions easier to unit test than returning HttpResponseMessage directly.

A Web API returns data (JSON or XML) for other programs — SPAs, mobile apps, other services — instead of HTML pages. In Web API 2 controllers inherit ApiController and actions are selected by HTTP method.

Client–server, statelessness, cacheability, a uniform interface (resources identified by URIs, manipulated through representations), a layered system and optional code-on-demand. Most “REST” APIs follow the first four.

With convention-based routing (api/{controller}/{id}) it matches the HTTP method to the action name prefix (GetProducts, PostProduct) or to [HttpGet]/[HttpPost] attributes, then matches parameters. Attribute routing with [RoutePrefix] and [Route] is clearer.

Ok() 200, Created(location, dto) 201, StatusCode(HttpStatusCode.NoContent) 204, BadRequest(ModelState) 400, Unauthorized() 401, NotFound() 404, Conflict() 409 and InternalServerError() 500.

Web API chooses the response format (JSON or XML) based on the Accept header and the registered media-type formatters.

DelegatingHandler classes that process every HTTP request and response before routing — used for cross-cutting concerns such as API keys, logging and correlation IDs.

Implement an ExceptionFilterAttribute for controller exceptions and replace IExceptionHandler and IExceptionLogger services for unhandled exceptions across the pipeline.

Simple types (int, string, DateTime) come from the URI by default; complex types come from the body via a media-type formatter. Use [FromUri] or [FromBody] to override, and only one parameter can be read from the body.

Data Annotations on DTOs fill ModelState during binding. Check ModelState.IsValid in the action or register a ValidateModelAttribute action filter globally that returns 400 with the errors.

1public class ValidateModelAttribute : ActionFilterAttribute
2{
3    public override void OnActionExecuting(HttpActionContext context)
4    {
5        if (!context.ModelState.IsValid)
6            context.Response = context.Request.CreateErrorResponse(HttpStatusCode.BadRequest, context.ModelState);
7    }
8}

Implement or plug in an IDependencyResolver (Unity.WebApi, Autofac.WebApi2, Simple Injector) and assign it to GlobalConfiguration.Configuration.DependencyResolver. Use a per-request scope for DbContext.

A DbContext with DbSet<T> properties, a connection string in Web.config, migrations with Enable-Migrations/Add-Migration/Update-Database, async queries (ToListAsync) and projection to DTOs. Disable lazy loading and proxies for serialisation.

Accept filter values as parameters, build an IQueryable conditionally and whitelist sort fields with a switch or dictionary mapped to expressions. Never pass a raw column name into SQL.

Install Swashbuckle, enable it in SwaggerConfig, turn on XML documentation comments in the project and include them so descriptions appear in Swagger UI at /swagger.

The OWIN OAuth authorization server middleware issues bearer tokens from a /token endpoint after validating credentials; the bearer authentication middleware validates them on each request, and [Authorize] protects controllers. JWT middleware is a common alternative.

Install Microsoft.AspNet.WebApi.Cors, call config.EnableCors() and apply [EnableCors(origins: "https://app.example.com", headers: "*", methods: "*")] to controllers or globally. Do not use "*" origins with credentials.

Move incrementally: create an ASP.NET Core project, port models and services first, replace ApiController with ControllerBase and [ApiController], move configuration from Web.config to appsettings, replace the DI container, and use YARP to route traffic between old and new apps during the transition.

Use URL segments (api/v1/products), a query string or a header, with the Microsoft.AspNet.WebApi.Versioning package or route prefixes per version. Keep old versions running until clients migrate and document deprecation.

Check Request.Content.IsMimeMultipartContent(), read with a MultipartFormDataStreamProvider to a temp folder, validate size and type, and move files to permanent storage with server-generated names. Set maxRequestLength and maxAllowedContentLength.

Inject fake services, call the action and assert on the IHttpActionResult type (OkNegotiatedContentResult<T>, NotFoundResult, CreatedAtRouteNegotiatedContentResult<T>). Set Request and Configuration when the action builds URLs.

Async actions for I/O, projecting to DTOs with AsNoTracking, output caching headers, compression in IIS, removing the XML formatter if unused, pooling HttpClient, and paging large results.

Publish from Visual Studio or a pipeline (MSBuild + Web Deploy or a zip deploy), set connection strings and app settings in the portal so they override Web.config, enable Always On and HTTPS Only, and monitor with Application Insights.