Building REST APIs — Chapter Quiz

Question 1

1

Which is the correct status code for a successful POST that created a resource?

A200B201 CreatedC204 No ContentD202 Accepted

201 = Created. Use 200 for general success, 204 for "no body to return" (e.g. DELETE).

Question 2

2

401 means 'I know who you are, but you can't do this.'

TTrueFFalse

401 = "I don't know who you are" (no/invalid auth). 403 = "I know you, you can't."

Question 3

3

Why should controllers stay thin?

AFor performanceBSo business logic stays in services — testable, reusable, framework-agnosticCExpress requires itDNo reason

Thin controllers + fat services = code that's testable without booting an HTTP server, and reusable in CLIs or queue workers.

Question 4

4

Why validate input with Zod at the boundary?

ATypeScript types are runtime checksBTS types vanish at runtime — Zod actually validates the bytes that arrivedCIt is faster than TypeScriptDRequired by Express

TS is compile-time only. Attackers send arbitrary JSON. Validate at the boundary with a runtime schema.

Question 5

5

What's wrong with offset-based pagination?

ASlow on big tables, can show duplicates/missing items when data changesBCannot be combined with sortingCNot supported by ExpressDNothing — it is always the right choice

OFFSET N makes the DB scan N rows. Inserts/deletes between pages shift everything. Cursor pagination is more stable.

Question 6

6

URL-path API versioning typically looks like /api/___/users.

/api/v1/users. Bump the version when you ship a breaking change.

Question 7

7

Which error response is most future-proof?

A{ message: "..." }B{ error: { code: "user_not_found", message: "..." } }CA bare stringDAn HTML page

Structured with a stable machine-readable code field. Clients can branch on the code; the message is for humans.

Question 8

8

Which describe a properly designed REST endpoint?

Select all that apply.

AURL is a noun, method is the verbBCollections are pluralized (/users)CStatus codes accurately reflect the resultDPagination is cappedEEvery endpoint accepts any HTTP method

The last one is wrong — each endpoint declares which methods it handles. Unsupported methods return 405.

Test what you learned.