Apple Java Developer Interview Questions & Answers

At a high level, I would design a simple REST API for a task application. The API exposes versioned task routes under /api/v1/tasks for reading, creating, updating, and deleting tasks. The client sends HTTPS requests with a Bearer JWT. The Controller validates and binds the request, the Service applies business rules and transaction handling, and the Repository uses JPA or JDBC with PostgreSQL. A successful create returns 201 Created with the saved task data and links. I would keep additive changes in v1 and use v2 for breaking changes. The trade-off is extra maintenance while versions overlap.

This question asks me to design a clear way for a web or mobile application to work with tasks. The client needs to create tasks, read them, change them, and delete them. I also need to show what information the client sends and what comes back after a request. Another goal is to let the interface change later without suddenly breaking older clients. I would explain the design in the same order as the diagram: client request, application processing, database access, response, versioning, errors, and monitoring.

• Is this interface mainly for our own web and mobile clients?
• Do we expect older clients to remain active when breaking changes are introduced?

I would use one Spring Boot Task API inside the Java Application Boundary. The Web / Mobile Client stays outside that boundary. PostgreSQL also stays outside because it is the persistent data store.

The client sends requests to the API over HTTPS with a Bearer JWT. The diagram keeps the design focused. It does not add an API gateway, cache, queue, or other infrastructure.

The task resources use URI versioning under /api/v1.

The API surface is:

• GET /api/v1/tasks
• GET /api/v1/tasks/{id}
• POST /api/v1/tasks
• PATCH /api/v1/tasks/{id}
• DELETE /api/v1/tasks/{id}

GET reads tasks. POST creates a task. PATCH changes part of one task. DELETE removes one task. The {id} value identifies one task.

For the create flow, the client sends POST /api/v1/tasks. The request contains title, description, dueDate, priority, and status.

The Controller receives the REST request. It owns the REST endpoints, request validation, and DTO binding. A DTO is a small object that carries request data inside the application.

The request then moves from the Controller to the Service. The flow includes validation and DTO mapping before the business work continues.

The Service owns business logic, transaction management, and DTO mapping. It applies the rules for the task and then calls the Repository.

The Repository owns data access, JPA repositories, and entity mapping. It communicates with PostgreSQL through JPA or JDBC.

This separation gives each layer one clear responsibility. HTTP handling stays in the Controller. Business rules stay in the Service. Database work stays in the Repository.

After the task is created, the API sends a separate response back to the Web / Mobile Client.

The response status is 201 Created. The response contains id, title, description, dueDate, priority, status, createdAt, updatedAt, and links.

The id identifies the stored task. The timestamps show when it was created and updated. The links provide related API locations. The important point is that this response travels from the API back to the client.

The diagram defines one standard error body: { code, message, details, traceId }. This gives clients one predictable shape for API errors. The traceId can also help connect a client-visible error with operational records.

For versioning, I would keep non-breaking additive changes in /api/v1. Breaking changes move to /api/v2. When an old version is being retired, the API can mark it with Deprecation and Sunset headers.

The Spring Boot Task API sends request logs, latency, and status information to Logs / Metrics. That flow supports centralized logging and metrics collection.

This is a supporting path. It is not part of the normal business response path. The client response still returns directly from the API to the Web / Mobile Client.

The design is intentionally simple. Resource-style routes make the task operations easy to understand. The Controller handles REST requests and validation. The Service keeps business rules and transaction handling. The Repository isolates PostgreSQL access. The benefit is clear ownership. The downside is that even a small application has several layers to maintain. URI versioning is also easy for clients to see. Additive changes can stay in /api/v1, while breaking changes move to /api/v2. The downside is that two versions may need support at the same time. A standard error body makes failures easier for clients to handle. Request logs, latency, and status metrics make production problems easier to investigate, but they add operational work.

At a high level, I would design a small CRUD API for tasks. The API Consumer sends an HTTP request to TaskController, which implements the TaskApi interface and handles request mapping and validation. Validated task input goes to TaskService for business rules, then TaskRepository performs the database operation. Results return through the same layers as TaskResponse plus an HTTP status. For consistent failure handling, validation, business, and data errors go through one Exception Mapper. The trade-off is extra layers, but each responsibility stays clear and easier to maintain.

This question asks me to design a simple way for another program to create, read, change, and delete tasks. I need to explain what information comes in, what comes back, and which part does each job. The main challenge is keeping the work clear and easy to change without adding too many moving pieces. I also need to show what happens when something goes wrong. I will follow the picture from the caller, through the task-handling parts, to stored task data, and then explain how the result or error returns.

• Are these four task operations enough for the first version?
• What fields should TaskRequest and TaskResponse contain?
• What validation rules should apply to task input?
• Are there database rules that affect create, update, or delete operations?

I would start by defining the operations the API supports. The diagram shows POST /tasks, GET /tasks/{id}, PUT /tasks/{id}, and DELETE /tasks/{id}. The TaskApi interface represents these operations in Java. It has createTask(TaskRequest), getTask(id), updateTask(id, TaskRequest), and deleteTask(id). TaskController implements this interface.

The request can contain path parameters, query parameters, or a JSON TaskRequest. The output is TaskResponse JSON plus an HTTP status. Keeping this contract clear makes it easier for callers and the implementation to agree on expected behavior.

The API Consumer can be a web, mobile, or partner application. It sends an HTTP request to TaskController inside the Java Application boundary.

TaskController handles HTTP and maps the request and response. It produces validated task input before calling TaskService. If validation fails, the controller sends the validation error to the Exception Mapper instead of continuing through the normal success path.

This keeps request-specific work near the edge of the application.

TaskController sends validated task input to TaskService. TaskService owns the business rules and orchestration. The controller delegates this work instead of putting business decisions inside HTTP handling.

TaskService decides which persistence action is needed and sends a CRUD command to TaskRepository. If a business or data error occurs on this path, TaskService sends that error to the Exception Mapper.

This keeps business behavior separate from both HTTP handling and database access.

TaskRepository owns persistence. Its responsibilities are save, find, update, and delete.

TaskService sends a CRUD command to TaskRepository. The repository sends an SQL query or transaction to the Relational Database, which stores the tasks table. The database returns rows or a result to TaskRepository. TaskRepository then returns the Task entity to TaskService.

This prevents the controller and service from directly handling SQL details.

The response uses separate arrows back through the application. TaskRepository returns the Task entity to TaskService. TaskService returns TaskResponse plus an HTTP status to TaskController.

TaskController maps that result into the HTTP response and sends it back to the API Consumer. The diagram does not define exact success status numbers, so I would not invent them.

The Exception Mapper provides one consistent error path. Validation errors from TaskController and business or data errors from TaskService flow into it.

The Exception Mapper converts exceptions into standard error JSON. It then returns a 4xx or 5xx error JSON response to the API Consumer, as shown in the diagram.

The main trade-off is extra layers and mappings. That adds code, but each layer has one clear responsibility. The design is easier to test, maintain, and change without mixing HTTP, business, and persistence concerns.

The main design choice is separation of responsibility. TaskController handles HTTP, request mapping, response mapping, and validation. TaskService handles business rules and orchestration. TaskRepository handles persistence. The benefit is that each part stays focused and easier to test. The downside is more classes and more mapping between layers. The TaskApi interface also makes the contract clear, but it adds another abstraction to maintain. A single Exception Mapper keeps 4xx and 5xx error JSON consistent instead of formatting errors in several places. The database path is synchronous, so the current request waits for the repository and database result before returning. This design is simple enough for an interview while still showing clear boundaries and failure handling.

At a high level, I would expose one versioned endpoint, POST /v1/arrays/reverse, that accepts an items array and an optional inPlace flag. The Java application validates the request, then uses a two-pointer algorithm to reverse the array in O(n) time. With inPlace=true, it reverses the server-owned working array. With false, it creates a separate reversed copy. A 200 response returns reversedItems, inPlace, and length. The main trade-off is memory: copy mode is simpler for preserving the working array, while in-place mode uses less auxiliary space.

This question asks us to design a small service that receives a list of values and sends those values back in reverse order. We need to decide what the caller sends, what the service returns, and what the in-place option really means. We also need simple rules for bad input and very large lists. The goal is a clear and predictable API. The diagram keeps the solution small: one Java application validates the request, reverses the array, formats the result, and sends the response back.

• Should the array allow mixed value types and null values?
• What maximum array length should the API accept?
• Should inPlace default to false when the caller omits it?

I would use the versioned endpoint POST /v1/arrays/reverse. The request uses Content-Type: application/json. Its required field is items, which must be an array. The optional inPlace field is a boolean and defaults to false. The diagram allows strings, numbers, booleans, and null values, including mixed types. An empty array is also valid.

For example, the caller can send {"items":["a","b","c"],"inPlace":true}. The client sends this HTTP request to the Java application.

The Input & Behavior Validation step checks the request. The payload must not be null. The items field must exist and must be an array. The inPlace field must be a boolean when provided. The design also uses a maximum-length guardrail, shown as about 100,000 elements.

If the JSON is invalid, items is missing, or a field has an invalid type, the API returns 400. If the payload is too large and exceeds the limit, it returns 413.

This is an HTTP JSON API. The server receives serialized data and creates its own in-memory representation. Therefore, inPlace=true means the Java application reverses its server-owned deserialized working array directly. It does not mutate the caller's original array or preserve client-side object identity.

When inPlace=false, which is the default, the server creates a separate reversed copy. The flag therefore controls server-side memory behavior, not mutation of a collection in the caller's process.

The Reverse Engine performs the reversal. It uses two pointers, one at the left end and one at the right end. It swaps those elements, moves both pointers inward, and continues until they meet.

This takes O(n) time. The in-place reversal algorithm needs O(1) auxiliary working space after request deserialization. Copy mode needs O(n) additional space for the separate reversed server-side array.

The Result Formatter builds the success response. It returns the reversed array, the effective inPlace value, and the array length. For the example request, the result is {"reversedItems":["c","b","a"],"inPlace":true,"length":3}.

The Java application returns the result to the client as 200 OK with Content-Type: application/json. The response is a separate flow from the Java application back to the client.

I would keep this API stateless. The server does not retain request state after returning the result, and no persistence layer is needed. The /v1 path provides a version boundary for backward compatibility.

The main trade-off is memory. In-place reversal uses less auxiliary working memory, but the HTTP request and response still require memory for deserialization and serialization. Copy mode preserves the original server-side working array, but it needs O(n) additional memory. The maximum-length guardrail helps control memory use and processing time.

At a high level, I would hide REST details behind a typed Java client so application code stays simple. The Application Service calls a versioned UserApiClient interface. The client maps DTOs, adds a JWT or API key, and sends HTTPS through Java HttpClient or Spring WebClient. The API Gateway routes the request to /api/v1/users or /api/v2/users. Responses return as JSON plus a status code, then become typed DTOs or mapped Java exceptions. I would also use timeouts, retries, circuit breaking, logging, and a clear deprecation window. The trade-off is extra client maintenance for safer version upgrades.

This question asks how I would build a Java client that talks to a REST service while supporting more than one API version. The goal is to keep normal application code simple even when the remote API changes. The main challenge is letting old callers continue with v1 while newer callers move to v2. The client also needs authentication, clear error handling, and protection from slow or failing remote calls. I would explain the design by following the exact path in the diagram from the Java application to the REST service and back.

• Do we need to support v1 and v2 at the same time?
• Should the version be carried in the URI path, a header, or both?
• How long should an old version remain supported before deprecation?
• Should the client use a JWT, an API key, or either option?

I would start with the Application Service calling UserApiClient through a typed method call. Inside the Java REST Client Library, I would expose versioned interfaces such as V1Client and V2Client. This keeps URLs, headers, JSON handling, and HTTP details outside business code. Separate interfaces or packages also let old callers remain on v1 while new callers move to v2.

The Version Config / Registry stores the base URL, default version, supported versions, and deprecation policy. It selects v1 or v2 for the client interface. The diagram prefers explicit versioning through a URI or header. For example, the service exposes /api/v1/users and /api/v2/users. A header such as X-API-Version can also carry the selected version. The important point is that the chosen contract is clear to both the client and server.

The selected interface sends the call to the Request Builder + DTO Mapper. It maps domain objects into request DTOs. DTOs can be shared when the versions remain backward compatible. Otherwise, each version should use its own DTOs. The Auth Interceptor then adds the JWT or API key. This keeps authentication handling in one client component instead of duplicating it in every caller.

The HTTP Transport uses Java HttpClient or Spring WebClient. It sends an HTTPS GET or POST request with the selected version in the path or header. Retry, timeout, and circuit-breaker behavior surrounds outbound calls. These controls reduce the effect of slow or temporarily failing remote calls. The transport also sends latency, status, and retry information to Logging + Metrics for logs, metrics, and tracing.

The API Gateway / REST Endpoint receives the request and routes it to v1 or v2. The selected REST resource is /api/v1/users or /api/v2/users. That resource calls the Backend Service, which owns the business logic and data access. The Backend Service returns its payload and status to the versioned resource. The HTTP response then moves back through the gateway toward the Java client.

The gateway returns JSON and the HTTP status code to the HTTP Transport. The response body then moves to the Response Parser + Error Mapper. This component parses JSON into DTOs. It also handles HTTP 4xx and 5xx responses and converts them into Java exceptions. Finally, the Application Service receives either a typed result or a mapped exception.

I would introduce a new interface or package beside the existing version instead of changing v1 in place. Both versions can remain available during a compatibility window. The deprecation policy should advertise the sunset date for the older version. The benefit is safer migration. The downside is temporary duplication in interfaces, DTOs, tests, and maintenance while both versions are supported.

The benefit of this design is that application code does not need to manage URLs, JSON parsing, authentication headers, or HTTP errors directly. Versioned interfaces also let v1 and v2 exist together, which makes migration safer. The downside is extra client code, tests, and maintenance while both versions are supported. URI versioning is easy to see and debug, while header versioning keeps URLs cleaner but makes the chosen version less visible. Timeouts, retries, and circuit breaking improve resilience around outbound calls, but they add configuration and operational complexity. Mapping 4xx and 5xx responses into Java exceptions gives callers a simple model, but the mapping must preserve enough information for debugging. We accept this added client complexity because it reduces breaking changes for application callers.

At a high level, I would keep retry handling inside the Java Application. The Business Service sends the outbound call through a Retry Executor and HTTP Client to the External API. A 2xx response returns normally. For temporary failures such as timeouts, 429, or 5xx, I wait one second and retry up to three times. I do not retry 400, 401, 403, or validation errors. If all attempts fail, I use structured logging, metrics, a circuit breaker, and a meaningful error or fallback. The trade-off is more latency and downstream load during failures.

The question asks how to make an outside service call more reliable when something temporarily goes wrong. We want the caller to get a useful result without trying forever. We also want to avoid repeating requests when another try will not help. The design makes one normal call first. Temporary problems can be tried three more times, with a one-second wait before each retry. Permanent problems stop immediately. If every allowed attempt fails, the application records the problem and returns an error or fallback. The explanation follows that exact flow.

• Does three retries mean three retries after the initial call?
• Which failures should be considered temporary and safe to retry?
• Can the operation create duplicate side effects when repeated?
• Is a fallback acceptable when the External API remains unavailable?

I would first explain the normal call. The Caller / Upstream Service sends a request to the Business Service inside the Java Application. The Business Service sends the outbound API request to the Retry Executor. The Retry Executor owns the retry policy. It sends HTTP request attempt n through the HTTP Client. The HTTP Client then sends the request to the External API. Keeping retry ownership inside the Java Application makes the policy clear and controlled.

The External API returns the HTTP response to the HTTP Client. The application then evaluates the Response status? decision. A 2xx response follows the success path. That success response returns to the Business Service and then to the Caller / Upstream Service. A timeout, 429, or 5xx follows the retryable path. These failures may be temporary. A 400, 401, 403, or validation error follows the non-retryable path. Repeating the same request normally will not fix those problems.

For a retryable failure, the flow goes to Sleep / scheduled delay and waits one second. It then checks Attempts exhausted?. The design allows one initial call plus up to three retries, which means four total attempts. If fewer than three retries have been used, the flow returns to the Retry Executor. The Retry Executor sends another request through the HTTP Client. The loop stops as soon as one attempt succeeds or all three retries have been used.

For a non-retryable failure, the application skips the retry loop and goes directly to Failure Handling. The diagram shows 400, 401, 403, and validation errors here. A 400 usually means the request is invalid. A 401 means authentication is missing or invalid. A 403 means the caller is not allowed to perform the action. Retrying the same request would add delay without fixing the cause.

If the attempts are exhausted, the flow also goes to Failure Handling. I would use structured logging to capture useful failure details. I would record metrics and alerts so repeated failures become visible. The design also includes a circuit breaker for repeated downstream failures. The application then returns a meaningful error or fallback to the Caller / Upstream Service. If recovery should continue later, the design allows an async handoff or dead-letter queue instead of keeping the synchronous request open.

I would finish by discussing idempotency. Idempotency means repeating an operation does not create an unwanted extra effect. The diagram treats GET, PUT, and DELETE as safe retry cases. For POST, I would use an idempotency key before retrying. This matters because a timeout does not prove the External API did nothing. The operation may have completed even when its response was lost. The retry policy therefore improves reliability, but retries must remain safe.

The benefit of this design is that retry behavior is controlled in one place inside the Java Application. The Retry Executor allows one initial call and up to three retries, with a one-second delay. This can recover from temporary timeouts, 429 responses, or 5xx failures. The downside is extra latency and more requests while the External API may already be unhealthy. The circuit breaker helps reduce that pressure when failures continue. Non-retryable 400, 401, 403, and validation errors fail quickly instead of wasting retries. Idempotency is also important because repeated operations can create duplicate effects. For POST operations, the design uses an idempotency key before retrying. We accept the added retry logic because it improves recovery from short-lived failures.

At a high level, I would hide each manufacturer’s API differences behind adapters and expose one stable contract to clients. The request enters through the API Gateway, which handles authentication, rate limiting, and versioning. Inside the Java application, I map the request into a canonical model, route it to the required manufacturer adapters, and call each vendor over HTTPS with mTLS. I normalize their responses, merge the results, and return one unified answer. The benefit is a simple client contract. The trade-off is extra translation and operational complexity.

The problem is that different manufacturers may describe the same product information in different ways. One may use different field names, formats, or values from another. I want clients to avoid understanding those differences. They should send one kind of request and receive one predictable answer. The design therefore converts the client request into one common internal shape, translates that shape for each manufacturer, converts every vendor response back into the common shape, and then builds one final response. The diagram shows this request and response flow from clients through the integration layer and back.

• Do we normally call one manufacturer or fan out to several manufacturers for one request?
• Which fields must always appear in the unified response?
• How much partial data can we return when one manufacturer fails?

I would first give clients one stable API contract. Client Apps send an HTTPS request with a JWT to the API Gateway. The gateway handles authentication, rate limiting, and API versioning in this design. After validation, it forwards the API request to the Unified Contract API inside the Java Application Boundary. The client does not need to understand each manufacturer’s format. This keeps the client-facing interface stable while vendor-specific details stay behind the integration boundary.

The Unified Contract API passes the incoming request into the Canonical Model. A canonical model is one common internal representation used across the integration layer. It defines the standard request and response schema. This is important because Manufacturer API A, B, and C may represent similar information differently. The canonical model lets the remaining Java components work with one consistent shape instead of carrying vendor-specific formats through the whole application.

The Orchestrator / Manufacturer Router receives the canonical request. It selects the required manufacturer adapter or adapters. The diagram also allows fan-out and collection when more than one manufacturer is needed. Manufacturer Adapter A, B, and C each translate between the canonical model and that manufacturer’s vendor format. This isolates manufacturer-specific rules. A vendor-specific mapping change is handled in its adapter instead of changing the client-facing contract.

Each adapter sends its vendor request to the matching external Manufacturer API over HTTPS with mTLS. mTLS means both sides use certificates to verify the secure connection. Secrets / Certificates stores API keys, OAuth secrets, and mTLS certificates used by the integration. The vendor request and vendor response are separate flows. Manufacturer API A returns to Adapter A, Manufacturer API B returns to Adapter B, and Manufacturer API C returns to Adapter C.

The returned vendor payloads move into the Response Normalizer. This component performs field mapping, enum mapping, and unit conversion. That turns different vendor formats into comparable canonical response parts. The Aggregator + Error Mapper then receives those canonical response parts. It merges results, normalizes errors, and supports a partial response when that behavior is appropriate. The Unified Response shown in the diagram contains client-facing fields such as sku, availability, price, currency, and eta.

The Fallback Policy contains retry, timeout, and circuit-breaker behavior. The Cache can supply hot data or a cached fallback response into that policy. This improves resilience when an upstream manufacturer is slow or unavailable, but cached data may be less fresh. Observability receives logs, metrics, and traces. It helps operators understand failures and latency, but it is not part of the business response path. After aggregation, the single unified response returns to the Unified Contract API. The API Gateway then returns the unified answer toward Client Apps. The main trade-off is a simpler client contract in exchange for more translation, mapping, fallback, security, and operational work inside the integration layer.

The main benefit is isolation. Clients depend on one contract instead of every manufacturer’s format. Each adapter contains vendor-specific translation, so manufacturer changes stay behind the integration boundary. The downside is more mapping code and more cases to test. Normalization must handle fields, enums, and units consistently. Fan-out can increase latency because several upstream calls may be involved. Timeouts, retries, and the circuit breaker improve reliability, but retries can create extra load. The cache can provide fallback data, but that data may be older. mTLS and stored credentials improve security, but certificates and secrets must be managed carefully. Rate limiting and versioning at the API Gateway improve control, while observability adds operational visibility.