Interview Corner

A: REST Assured is an open-source Java library for testing REST APIs. It provides a BDD-style fluent API — given() for request setup, when() for the HTTP method, then() for response validation. It is preferred because: 1) Tests are written in Java, fitting naturally into Maven/Gradle projects. 2) Built-in Hamcrest matchers provide readable assertions. 3) Automatic JSON/XML parsing without manual Jackson/Gson calls. 4) Integrates with TestNG and JUnit. 5) Supports authentication, cookies, multipart uploads. 6) Industry standard — most QA frameworks in Java use it.

A: Two ways. Inline with Hamcrest: .body("name", equalTo("John")), .body("items.size()", greaterThan(0)), .body("users.email", hasItem("admin@test.com")). Or extract and assert: Response response = ...extract().response(); String name = response.jsonPath().getString("name"); Assert.assertEquals(name, "John"). The Hamcrest approach is cleaner for simple checks. Extraction is better when you need the value for subsequent requests or complex logic. You can also deserialize to POJO: .extract().as(User.class).

A: REST Assured supports multiple auth types. Basic auth: given().auth().basic("username", "password"). Bearer token: given().header("Authorization", "Bearer " + token). OAuth 2.0: given().auth().oauth2(accessToken). For preemptive basic auth (sends credentials without waiting for 401): given().auth().preemptive().basic("user", "pass"). In real frameworks, I put the auth setup in RequestSpecBuilder so every request includes the token. The token itself comes from environment variables or a config file, never hardcoded.

A: .body() validates inline — the test fails immediately if the matcher does not match. It is declarative: "this field MUST have this value." .extract() pulls data out of the response for use in Java code — you get a Response object or a specific value. Use .body() when you just need to validate. Use .extract() when you need the value for the next request (like extracting a token from login, or an ID from create). You can combine both: validate first with .body(), then .extract() at the end.

A: Three ways: 1) String body — pass a raw JSON string to .body(). Quick but error-prone. 2) HashMap — create a Map<String, Object>, put key-value pairs, pass to .body(). REST Assured converts to JSON. 3) POJO — create a Java class matching the JSON structure with getters/setters, pass the object to .body(). Jackson serializes it. Always set .contentType(ContentType.JSON). The POJO approach is best for frameworks because it is type-safe, reusable, and IDE-autocomplete friendly.

A: RequestSpecBuilder creates a reusable request template — base URI, content type, headers, auth. ResponseSpecBuilder creates a reusable response validation template — expected status code, content type, response time. Define them in @BeforeClass, use .spec(requestSpec) in given() and .spec(responseSpec) in then(). Benefits: eliminates duplication, centralizes config, easy maintenance. When the base URL changes, you update one line. In frameworks, these live in a BaseTest class that all test classes extend.

A: Use .extract().as(ClassName.class). REST Assured uses Jackson (or Gson) under the hood. The POJO must have: a no-arg constructor, fields matching JSON keys (or @JsonProperty annotations), and getters/setters. For arrays: .extract().as(User[].class) returns an array. For a list: use .extract().jsonPath().getList("users", User.class). Jackson must be on the classpath — add jackson-databind to pom.xml. Deserialization is essential for chained tests where you create a resource and then use its fields in subsequent requests.

A: Request logging: given().log().all() logs method, URI, headers, body. Response logging: .then().log().all() logs status, headers, body. For production tests: .log().ifValidationFails() logs only when assertions fail — clean output on success, full details on failure. Global setting: RestAssured.enableLoggingOfRequestAndResponseIfValidationFails() applies to all tests. Selective logging: .log().uri() for URL only, .log().headers() for headers only, .log().body() for body only. Never use .log().all() in CI permanently — it can leak auth tokens in logs.