Backend practice
Each challenge is a brief someone could plausibly hand you, followed by what is actually going on underneath it. Read the brief and decide what you would build before you open anything else — and read the trap on every single one, because the trap is the fix that looks right.
One endpoint, done properly. Status codes, validation layers, where a handler stops.
Transactions, pools, caches, jobs and the first dependency you do not control.
Idempotency, races on one row, webhooks, backpressure, deploys that do not drop requests.
Multi-tenancy, distributed failure, migrations under a rolling deploy, and incidents with no error rate.
Beginner
One endpoint, done properly. Status codes, validation layers, where a handler stops.
Add POST /notes. It takes a title and a body, stores the note, and returns it with its id. Return the right status code and set the Location header.
POST /signup takes an email, a password and an optional referral code. Reject bad input with a clear, actionable error. The frontend already validates the same fields.
GET /me should return the current user's profile. Anonymous callers get 401. Add authentication to the route.
Round out /notes with list, read, update and delete. Keep the code organised so it can grow.
Your service returns 500 with a stack trace for everything that fails, including invalid input. Fix the error handling.
Intermediate
Transactions, pools, caches, jobs and the first dependency you do not control.
POST /transfers moves an amount from one account to another and writes two ledger entries. Neither side may end up wrong.
GET /feed returns every item. The table has grown and the endpoint is now slow and occasionally times out. Add pagination.
GET /users/:id/profile is the most-called endpoint you have and it queries four tables. Add caching.
Signup currently sends a welcome email inline. When the email provider is slow, signups are slow; when it is down, signups fail. Move it to a background job.
Accept payment events from your provider and mark orders as paid. The provider retries any non-2xx and does not guarantee ordering.
Users upload avatars. The current endpoint buffers the file in memory and writes it to object storage. Memory spikes are causing restarts.
Advanced
Idempotency, races on one row, webhooks, backpressure, deploys that do not drop requests.
POST /checkout charges a card and creates an order. Clients retry on timeout. Make it safe.
A ticketing endpoint oversells popular events. It reads availability, checks it, and inserts a booking. Fix it without serialising every booking in the system.
A shared-schema SaaS returned another customer's rows from a reporting endpoint. One query was missing its tenant filter. Make this class of bug structurally impossible.
Your payment provider starts returning intermittent 503s and slow responses. Your service currently has no timeouts and no retries. Design the policy.
An ingest endpoint accepts events and enqueues them. During a traffic surge the queue depth grows continuously and processing falls hours behind. Design the response.
Expert
Multi-tenancy, distributed failure, migrations under a rolling deploy, and incidents with no error rate.
Every page view increments a counter. A few items are extremely popular. The single-row update per view is now the hottest write in the database and is causing lock waits across unrelated queries.
A recommendations service becomes slow. Within minutes the product API, checkout and the mobile gateway are all failing, although none of them depends on recommendations for anything essential. Explain and fix.
Placing an order must reserve inventory, charge payment, create a shipment and notify the customer. Four services, four databases. Design the workflow and its failure handling.
p99 latency on the main API tripled over a week. p50 is unchanged. Error rate is flat. There were eleven deploys, a database version upgrade, and a large new customer onboarded. Find the cause.