Job application tracker

Explain what your Job Application Tracker does and what problem it solves.

I built a Job Application Tracker API to help users record and manage job applications in one place. It supports the core CRUD operations: creating an application, retrieving applications, retrieving an individual application, updating an application and deleting one. I used FastAPI to expose the API, Pydantic for request validation, SQLAlchemy for database interaction and SQLite for persistence.

Why did you build the Job Application Tracker?

I wanted to build a practical backend project that would let me apply core software engineering concepts rather than only write isolated scripts. It gave me experience designing API endpoints, validating incoming data, modelling persistent data and implementing CRUD operations.

Walk me through the architecture of your Job Application Tracker.

The client sends an HTTP request to the FastAPI application. The relevant route receives the request, and Pydantic validates the incoming data where a request schema is used. The route then uses SQLAlchemy to interact with the SQLite database. The API returns an appropriate HTTP response, usually containing JSON data for successful requests.

What happens when a client sends a POST request to create an application?

• The client sends a POST request to the applications endpoint with a JSON request body. FastAPI uses the Pydantic request schema to validate the incoming data. The route then creates a database model instance, adds it to the SQLAlchemy session, commits the transaction and returns a response representing the created record.

• 
  

Why did you choose FastAPI?

I chose FastAPI because it provides a straightforward way to build Python APIs, integrates with Pydantic for request validation, supports asynchronous endpoints where needed and automatically generates interactive API documentation. It allowed me to focus on backend concepts while still building a structured API.

Explain the CRUD endpoints in your project

The API included GET /applications/ to retrieve applications, POST /applications/ to create one, GET /applications/{application_id} to retrieve an individual application, PUT /applications/{application_id} to update one and DELETE /applications/{application_id} to delete one.

What is the purpose of the automatically generated Swagger UI?

It provides interactive API documentation where developers can inspect available endpoints, understand request and response schemas and send test requests.

• What is the difference between PUT and PATCH?

PUT generally replaces the resource representation, while PATCH applies a partial update. The exact semantics depend on the API contract.

What is REST, and how does your project follow REST principles?

REST is an architectural style for designing networked APIs around resources. My API exposes job applications as resources and uses standard HTTP methods such as GET, POST, PUT and DELETE to retrieve, create, update and remove them. It also uses resource-oriented URL paths and JSON representations.

What does stateless mean in REST?

Each request should contain the information needed to process it. The server should not rely on hidden client session state from a previous request to understand the current request.

What is Pydantic used for in your FastAPI project?

Pydantic defines schemas for incoming and outgoing data. FastAPI uses those schemas to validate and parse request data, so the application can work with data in an expected structure and return clear validation errors when input is invalid.

Is a Pydantic schema the same thing as a SQLAlchemy model?

No. A Pydantic schema describes and validates data entering or leaving the API. A SQLAlchemy model maps Python classes to database tables and represents persisted data.

What is SQLAlchemy and how did you use it?

SQLAlchemy is a Python SQL toolkit and ORM. I used it to map Python classes to relational database tables and interact with the database through objects and sessions instead of writing every SQL statement manually. It provides a structured way to create, query, update and delete records.

What is a database session?

A session manages a unit of interaction with the database. It tracks changes to objects and is used to query, add, update and delete records, then commit or roll back a transaction

How did you implement authentication in your Job Application Tracker?

I implemented a login flow that returns a JSON Web Token after the user's credentials are authenticated. The client can then send the token with subsequent requests. Protected routes can validate the token and identify the current user before allowing access to protected functionality.

What information is normally stored in a JWT?

JWT contains claims, such as a subject identifying the user and an expiry time. It is signed so the server can verify that it has not been tampered with. Sensitive information such as passwords should not be placed in its payload.

Why should passwords be hashed instead of stored as plain text?

Passwords should be stored as secure password hashes rather than plain text. If the database is exposed, hashing makes it much harder for an attacker to recover the original passwords. Password hashing should use a purpose-built, salted, deliberately slow password-hashing algorithm.

How would you ensure users can only access their own applications?

I would obtain the authenticated user's identity from the validated token and apply that identity to database queries. For example, retrieving an application should check both its ID and its owner ID. I would apply the same ownership check to updates and deletes, rather than relying only on the fact that a user is logged in.

How should your API handle a request for an application that does not exist?

he API should return an HTTP 404 Not Found response when a requested application ID does not exist. This gives the client a clear indication that the resource could not be found, rather than returning a misleading success response.

What is the difference between a 400, 401, 403, 404 and 500 status code?

400 means the request is invalid; 401 means authentication is missing or invalid; 403 means the user is authenticated but not permitted; 404 means the resource was not found; 500 indicates an unexpected server-side error.