Query parameters

Query parameters are the part of a URL after the question mark — ?status=open&sort=-created&limit=20. They do not identify a different resource; they modify the request for the one the path names, which is why they are the conventional home for filtering, sorting, pagination, search terms and output options.

How it works

Pairs are separated by & and each value is percent-encoded, so a space becomes %20 and an ampersand inside a value becomes %26. Repeated keys (?tag=a&tag=b) are legal but have no standard meaning — frameworks variously keep the first, the last or all of them. Because they are part of the URL, they end up in logs, browser history and caches.

The misconception

That unknown query parameters are harmless. Many APIs silently ignore a misspelled filter — ?stauts=open — and return everything, which looks like success and is a bug in the client. A strict API answers 400 instead; a test should check which kind yours is.

Try it here

The Search & Facets API rejects unknown query parameters on GET /search/v1/items, as does the Friends v1 character list. The Movies API combines filtering, sorting and pagination on GET /movies/v1/movies.

Sources

Other terms

REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
API endpoint — One URL plus one HTTP method — the smallest unit of an API that a client can call.
Path parameters — A variable segment of a URL path, such as the 42 in /orders/42, that identifies one specific resource.
HTTP headers — Name–value metadata sent with every request and response, separate from the body.
HTTP status codes — The three-digit number at the start of every HTTP response that says, before the body, what happened.
Content negotiation — Client and server agreeing on the format of a response, through headers rather than separate URLs.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 16 October 2026