FastAPI Interview Questions and Answers - Practice with Instant Scoring

Use an asynchronous database driver and SQLAlchemy AsyncSession when adopting async database access. Provide sessions through a dependency with controlled creation and cleanup. Avoid sharing a mutable AsyncSession across concurrent requests or tasks, and explicitly manage transaction boundaries.

Measure endpoint latency, event-loop blocking, database connection pool saturation, and external API response times. Check synchronous calls inside async endpoints, excessive serialization, worker counts, and CPU utilization. Use profiling and load testing to identify the bottleneck before increasing worker capacity.

Unverified tokens allow attackers to forge identity or authorization claims. Always verify signatures using trusted keys and an explicitly configured algorithm allowlist. Validate expiration, issuer, audience, and application-specific authorization requirements before trusting token contents.

Use reusable authorization dependencies that inspect authenticated user roles, permissions, or OAuth2 scopes. Security() can declare OAuth2 scope requirements and integrate them into OpenAPI documentation. For resource-level access, also verify ownership or policy rules against the requested resource.

BackgroundTasks runs work within the application's server process after the response has been sent. It is suitable for small, non-critical operations but does not provide durable scheduling or distributed retries. Use a task queue such as Celery with an appropriate broker for durable, retryable, or resource-intensive jobs.

Each worker is a separate process with its own memory, so global dictionaries are not shared across workers. Requests routed to different workers may observe inconsistent session state. Use a shared external store such as Redis or a database when session data must be accessible across processes.

Apply rate limiting using a reverse proxy, API gateway, or application-level limiter backed by shared storage. Use client identity, API keys, or authenticated user IDs as appropriate for limit keys. Return HTTP 429 when limits are exceeded and consider distributed enforcement across multiple workers.

Use FastAPI WebSocket endpoints to accept persistent bidirectional connections. Handle connection establishment, message reception, transmission, and disconnect exceptions. For multiple workers or servers, use a shared messaging system to distribute events across connected clients.

An in-memory connection manager only knows about WebSocket connections owned by its process. Other workers or instances maintain independent connection collections. Use Redis Pub/Sub or another message broker to propagate events, while each instance delivers messages to its own connected clients.

field_validator validates or transforms individual fields using supported validation modes. model_validator can inspect or transform the model as a whole, making it suitable for cross-field invariants. Example: Ensure an end date occurs after a start date or that two configuration fields are mutually exclusive.

Use a dedicated partial-update schema with optional fields and distinguish omitted values from explicitly provided values. In Pydantic v2, model_dump(exclude_unset=True) extracts only fields supplied by the client. Apply the resulting changes to the existing entity instead of replacing it with a model containing default values.

Execute related writes inside a single database transaction when they must succeed or fail together. Commit only after all required operations succeed and roll back on failure. For workflows spanning independent services, consider an outbox pattern, idempotency, or a saga rather than assuming one database transaction covers every service.

N+1 queries occur when loading a collection triggers additional database queries for related entities individually. Use eager-loading strategies such as selectinload() or joinedload() based on relationship cardinality and query requirements. Inspect generated SQL and measure query counts before choosing an optimization.

Organize modules by business domain, with routers, schemas, services, and persistence components separated by responsibility. Keep HTTP concerns in routers and business rules in service layers. Use dependency injection for infrastructure access and avoid circular imports through clear module boundaries.

asyncio.gather() schedules awaitable operations concurrently, but an exception can propagate while other tasks remain active. Define timeouts, cancellation behavior, and whether partial results are acceptable. Bound outbound concurrency and configure HTTP connection pools to avoid overwhelming dependencies.

Require an idempotency key and associate it with the authenticated client, request identity, and stored operation result. Use database uniqueness constraints and transactional coordination to prevent concurrent duplicate processing. Return the recorded result for valid retries and reject conflicting reuse of the same key.

The application may see the reverse proxy's internal HTTP connection instead of the original HTTPS scheme. Configure the proxy to forward the appropriate headers and configure the ASGI server to trust forwarded headers only from approved proxies. Verify the resulting request scheme and redirect URLs without blindly trusting client-supplied headers.

Worker count depends on available CPU, memory, blocking workload, traffic characteristics, and deployment architecture. Each worker runs in a separate process with its own event loop and application resources. Benchmark realistic traffic and monitor resource consumption rather than assuming that more workers always improve throughput.

Use OpenTelemetry instrumentation to capture incoming HTTP requests, outbound calls, and supported database operations. Propagate trace context using standard headers such as traceparent. Export traces to a compatible observability backend and correlate them with structured logs and request identifiers.

CPU-bound Python processing can monopolize execution resources and reduce responsiveness when performed directly on the event loop. Offload substantial CPU work to separate processes or dedicated background workers. For long-running jobs, return a job identifier and expose status or result retrieval endpoints.

Use a shared cache such as Redis and coordinate regeneration with a short-lived distributed lock or single-flight strategy. Allow stale-while-revalidate behavior where acceptable and add expiration jitter to reduce synchronized cache misses. Ensure lock expiration and failure handling prevent indefinite blocking or repeated expensive recomputation.

Use modular routers, validated schemas, reusable dependencies, and properly managed asynchronous resources. Deploy behind a trusted reverse proxy with TLS, authentication, authorization, rate limiting, and appropriately sized worker capacity. Add health probes, structured logging, metrics, distributed tracing, timeouts, and graceful shutdown handling. Validate reliability through automated tests, load testing, and deployment rollback procedures.