AI & Technical question
Create an API design for third-party integration for payments.
- Microsoft
- AI & Technical
- Hard
Practice this question out loud. An AI interviewer asks it, follows up like a real interviewer would, and scores your answer. Type or speak.
Start a mock interview on this question · Mock interview from a job description
What this question tests
Tests PM-level API design thinking for a payments integration: what a third-party developer needs, and how security and reliability shape the contract.
How to approach it
- Clarify the use case: a third-party merchant or app wants to accept payments through this platform via a REST API, not a full white-label payment stack.
- Define the core endpoints: create a payment intent, confirm a payment, handle refunds, and retrieve transaction status, mirroring how real payment APIs like Stripe are structured.
- Define authentication: API keys scoped per merchant, with a separate secret key for server-side calls and a publishable key for client-side tokenization, keeping raw card data off the merchant's servers.
- Address reliability: idempotency keys on payment creation so a retried request after a timeout doesn't double-charge the customer.
- Address webhooks: asynchronous events like payment.succeeded or payment.failed pushed to the merchant's server, since payment confirmation can be delayed by bank processing.
- Define success: third-party integration time-to-first-successful-payment, and API error/failure rate in production.
What a strong answer includes
- Names concrete endpoints and an idempotency mechanism, showing real payment-API design knowledge, not a vague API description.
- Separates client-side and server-side keys, addressing PCI-relevant security concerns explicitly.
- Proposes webhooks for asynchronous confirmation, reflecting how real payment settlement actually works.
- Defines success with a developer-experience metric, time-to-first-successful-payment, relevant to third-party adoption.
Common mistakes
- Describing only a generic REST API with no payment-specific security or idempotency considerations.
- Ignoring asynchronous settlement, assuming every payment confirms synchronously in the response.
Likely follow-up questions
- How would you version this API without breaking existing integrations?
- How would you handle a merchant's server missing a webhook event?
More ai & technical questions
- How will you design a web service that enables other developers to create online chat applications?Microsoft · AI & Technical · Hard
- How will you design a mobile version of MS Word and ensure real time collaboration within this app?Microsoft · AI & Technical · Hard
- Write an algorithm for a robot that has to get from point A to point B in a room.Microsoft · AI & Technical · Medium
- Design the security for a chat/messaging application.Microsoft · AI & Technical · Hard
- Design a system that can detect fraudulent use of Microsoft Word.Microsoft · AI & Technical · Hard
- Explain the architecture of your current or past product in detail.Flexport · AI & Technical · Easy
More questions from Microsoft
Learn the skill behind it
Chapters of the AI PM course that teach what this question tests.
- Chapter 1: Foundations: the model and the decisions it forces on you
- Chapter 8: Evals: define good and make the number defensible
- Chapter 6: Agents and agentic architecture