Architecture scenarioHard~12 minAPI Contracts & Design / 13 of 16

Interview question

How would you design consistent error handling across an ASP.NET Core API?

Design a consistent error handling strategy for ASP.NET Core APIs

Design API error handling across validation errors, conflicts, auth failures, not-found responses, and unexpected exceptions.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I use one error-handling boundary to translate known failures into consistent HTTP responses. Validation, not-found, conflict, authorization, rate-limit, and unexpected failures each have a deliberate status and machine-readable code. Controllers return normal results or raise known application failures instead of building ad hoc error objects. Unexpected exceptions are logged and returned as safe generic problems.

Full answer below

Practice focus

error contracts, ProblemDetails, exception boundaries, safe logging, client behavior, and retry semantics

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Design API error handling across validation errors, conflicts, auth failures, not-found responses, and unexpected exceptions. It matters in real backend work because the server has to enforce trust boundaries even when the UI, client, or caller behaves unexpectedly. The practical angle is error contracts, ProblemDetails, exception boundaries, safe logging, client behavior, and retry semantics, tied to a concrete production decision.
I use one error-handling boundary to translate known failures into consistent HTTP responses. Validation, not-found, conflict, authorization, rate-limit, and unexpected failures each have a deliberate status and machine-readable code. Controllers return normal results or raise known application failures instead of building ad hoc error objects. Unexpected exceptions are logged and returned as safe generic problems.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
The mapping preserves useful distinctions without exposing implementation details. A concurrency exception can become 409 with a recovery hint, while an invalid command becomes 400 or 422 with field errors. I use ProblemDetails as the envelope, add a stable code and correlation id, and keep messages safe for clients. Domain and application layers do not depend on HTTP; the API boundary owns the translation. Tests assert both the status and the response contract for each important failure path.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I also account for failures outside controller code, including authentication, middleware, model binding, request-size limits, downstream timeouts, and reverse proxies. They need compatible response shapes or clearly documented exceptions to the rule. I preserve cancellation rather than logging it as an internal fault, redact sensitive values, and avoid returning stack traces. Metrics group failures by stable code, route, dependency, and release so an incident is diagnosable. Contract tests and API documentation protect clients from accidental changes while internal exception types remain free to evolve.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Returning 200 with error payloads
Leaking stack traces
Catching everything and returning BadRequest
Different error shapes per endpoint
Making clients parse strings

Red flagsCandidateSigns the approach is fragileSignals that an interviewer may treat as risky.Open details

Details

Cannot explain status-code semantics
Treats exceptions as the only error model
Ignores security of details
Does not know retryable vs non-retryable

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

When would you return 409?
How would you include correlation ID?
Which errors are retryable?
How do validation and domain errors differ?

Continue the section

Next in API Contracts & Design: API Consistency

Step 14 of 16

API consistency across service boundaries

Opening drill

Architecture scenarioHard~12 minAPI Contracts & Design / 13 of 16

Interview question

How would you design consistent error handling across an ASP.NET Core API?

Design a consistent error handling strategy for ASP.NET Core APIs

Design API error handling across validation errors, conflicts, auth failures, not-found responses, and unexpected exceptions.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

error contracts, ProblemDetails, exception boundaries, safe logging, client behavior, and retry semantics

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Design API error handling across validation errors, conflicts, auth failures, not-found responses, and unexpected exceptions. It matters in real backend work because the server has to enforce trust boundaries even when the UI, client, or caller behaves unexpectedly. The practical angle is error contracts, ProblemDetails, exception boundaries, safe logging, client behavior, and retry semantics, tied to a concrete production decision.
I use one error-handling boundary to translate known failures into consistent HTTP responses. Validation, not-found, conflict, authorization, rate-limit, and unexpected failures each have a deliberate status and machine-readable code. Controllers return normal results or raise known application failures instead of building ad hoc error objects. Unexpected exceptions are logged and returned as safe generic problems.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
The mapping preserves useful distinctions without exposing implementation details. A concurrency exception can become 409 with a recovery hint, while an invalid command becomes 400 or 422 with field errors. I use ProblemDetails as the envelope, add a stable code and correlation id, and keep messages safe for clients. Domain and application layers do not depend on HTTP; the API boundary owns the translation. Tests assert both the status and the response contract for each important failure path.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I also account for failures outside controller code, including authentication, middleware, model binding, request-size limits, downstream timeouts, and reverse proxies. They need compatible response shapes or clearly documented exceptions to the rule. I preserve cancellation rather than logging it as an internal fault, redact sensitive values, and avoid returning stack traces. Metrics group failures by stable code, route, dependency, and release so an incident is diagnosable. Contract tests and API documentation protect clients from accidental changes while internal exception types remain free to evolve.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Returning 200 with error payloads
Leaking stack traces
Catching everything and returning BadRequest
Different error shapes per endpoint
Making clients parse strings

Red flagsCandidateSigns the approach is fragileSignals that an interviewer may treat as risky.Open details

Details

Cannot explain status-code semantics
Treats exceptions as the only error model
Ignores security of details
Does not know retryable vs non-retryable

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

When would you return 409?
How would you include correlation ID?
Which errors are retryable?
How do validation and domain errors differ?

Continue the section

Next in API Contracts & Design: API Consistency

Step 14 of 16

API consistency across service boundaries

How would you design consistent error handling across an ASP.NET Core API?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue the section

How would you design consistent error handling across an ASP.NET Core API?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue the section