Integration, APIs, and Headless Delivery
Integration questions test whether you can choose the right API and secure it. A candidate must know the Sling Servlets and Sling Models exporters, the JSON exporter, the Assets HTTP API, and the GraphQL endpoint for content fragments. Understand persisted queries (stored, cacheable, and preferred over ad hoc queries), the GraphQL schema generation from fragment models, and the role of the API gateway and CORS configuration. Know when to use server-side rendering versus a headless SPA or external front end, and how the SPA Editor bridges authoring and headless delivery.
Key concepts include OSGi services and the service registry, the Sling Resource Resolver and mappings, webhooks and Adobe I/O Events for integration triggers, and the use of external services via the HTTP client with timeouts and retries. Understand authentication options: service users, OAuth server-to-server credentials, and how the AEM as a Cloud Service token endpoints differ from on-premise. Also know the dispatcher's role in fronting APIs and why some endpoints must bypass the dispatcher.
Traps include assuming any servlet is publicly reachable (dispatcher filters and CSRF matter), or using ad hoc GraphQL queries in production where persisted queries are required for caching. Another trap confuses authentication with authorization, or assumes CORS is a security control rather than a browser policy. Expect questions on why an integration works on author but fails on publish (service user permissions, replication of configuration).
Rule of thumb: persist your queries, authenticate with service users or OAuth, and always test integration paths on publish through the dispatcher. Worked example: a mobile app needs article data. Publish the fragment models and fragments, create a persisted GraphQL query, expose it through the dispatcher with caching, and authenticate with a service user scoped to read-only access.