InternshipAll 60 tasks, level by level
The real graded Backend Development tasks the portal assigns, grouped into three levels.
The portal assigns these Backend Development tasks. Finish Level 1 before Level 2 and Level 2 before Level 3. Your mentor may mark some tasks as required for the certificate.
Level 1: Foundations (24 tasks)
| Task | What to do |
|---|---|
| How HTTP works | Use curl -v against two APIs and explain methods, status codes, headers and the body for each request in a README. |
| Your first server | Create a Node.js (Express) or Python (Flask/FastAPI) server with three routes returning JSON. Commit it to a repo named backend-internship. |
| REST design for a resource | Design REST endpoints for a library (books, members, loans) with methods, URLs, status codes and sample JSON. |
| CRUD with an in-memory store | Implement create, read, update and delete for books, with proper 201/404/400 responses. |
| Input validation | Validate request bodies with a library (zod, Joi or Pydantic) and return clear error messages for bad input. |
| Connect a SQL database | Move the books store to PostgreSQL, MySQL or SQLite. Write the CREATE TABLE statements and commit them. |
| SQL queries practice | Write 10 SQL queries on your library data: filters, joins, GROUP BY, ORDER BY and a subquery, with results. |
| Environment variables | Move database URLs and secrets into environment variables with a .env.example file and explain why secrets never go in Git. |
| Logging requests | Add request logging with method, path, status and duration. Show a sample of the log. |
| Error handling middleware | Add one central error handler so every error returns the same JSON shape without leaking stack traces. |
| API documentation | Document your API with OpenAPI/Swagger and serve the docs page from the server. |
| Test the API with Postman | Create a Postman collection with tests for every endpoint and export it to the repo. |
| Status code cheat sheet | Write a cheat sheet of 20 status codes with one example request for each from your own API. |
| Config per environment | Load different settings for development, test and production without code changes. |
| Request IDs | Add a unique request ID to every request and include it in logs and error responses. |
| Seed data script | Write a script that fills the database with realistic sample data for development. |
| Soft delete | Implement soft delete for books (deletedAt column) and exclude deleted rows from lists. |
| Timestamps and time zones | Store created and updated times in UTC and return ISO 8601 strings. Explain why. |
| CSV export | Add an endpoint that streams a CSV export of records without loading everything into memory. |
| Search endpoint | Add case-insensitive search across two fields with SQL LIKE or full-text search. |
| Health and readiness | Add separate liveness and readiness endpoints and explain the difference. |
| API versioning | Serve /v1 and /v2 of one endpoint where v2 changes the response shape. |
| Basic auth vs API key | Protect an admin endpoint with an API key header and explain its limits. |
| Linting and formatting | Add a linter and formatter to the project and fix every warning. |
Level 2: Building real features (20 tasks)
| Task | What to do |
|---|---|
| Authentication with passwords | Add sign-up and login with bcrypt-hashed passwords. Explain why you never store plain passwords. |
| JWT or session auth | Protect the write endpoints with JWT or sessions. Show what happens with no token, an expired token and a valid one. |
| Roles and permissions | Add admin and member roles. Only admins can delete books. Write tests for both roles. |
| Pagination, filtering and sorting | Add page, limit, search and sort query parameters to the books list with safe defaults and limits. |
| Database migrations | Use a migration tool (Prisma, Knex, Alembic or Flyway) to create and change the schema in versioned steps. |
| Indexes and query plans | Load 50,000 rows, time a slow query, add an index and show EXPLAIN output before and after. |
| Automated API tests | Write integration tests that start the server with a test database and cover the main flows. |
| File uploads | Add a book cover upload with size and type checks, storing files on disk or in cloud storage. |
| Rate limiting | Limit login attempts per IP and return 429 with a Retry-After header. Explain why this matters. |
| Containerise the API | Write a Dockerfile and docker-compose file that runs the API and database together with one command. |
| Refresh tokens | Add short-lived access tokens and long-lived refresh tokens with rotation and logout. |
| Password reset flow | Build a secure password reset with one-time, expiring tokens. |
| Email verification | Send a verification link on sign-up and block unverified users from some actions. |
| Audit log | Record who changed what and when for every write, and add an endpoint to read the log. |
N+1 query fix | Find an N+1 query in your API, fix it with a join or batching, and measure the difference. |
| Idempotent payments | Implement an Idempotency-Key header so retried create requests do not create duplicates. |
| Scheduled jobs | Run a nightly job that cleans expired sessions or sends a report. |
| Object storage | Store uploaded files in S3-compatible storage with signed URLs for download. |
| GraphQL endpoint | Expose the same data through a small GraphQL API and compare it with REST. |
| Load test | Load-test your API with k6 or autocannon and find the first bottleneck. |
Level 3: Professional work and capstone (16 tasks)
| Task | What to do |
|---|---|
| Caching with Redis | Cache the books list in Redis with a sensible expiry and clear it when a book changes. Measure the speed-up. |
| Background jobs | Send a welcome email (or log it) through a background job queue instead of inside the request. |
| Transactions and consistency | Make borrowing a book a database transaction so stock can never go negative, and prove it with a concurrent test. |
| Webhooks | Build an endpoint that receives a webhook, verifies its signature and processes it exactly once. |
| OWASP API security check | Review your API against the OWASP API Top 10 and fix at least three findings, documenting each. |
| Observability | Add a /health endpoint, structured JSON logs and basic metrics (request count and latency). |
| Deploy with CI | Deploy the API to a free host (Render, Railway or Cloud Run) with a GitHub Actions pipeline that runs tests first. |
| Capstone: production backend | Ship a complete backend for an app of your choice with auth, database, tests, docs, Docker and a live URL. Include an architecture diagram in the README. |
| Message queue integration | Publish an event when an order is placed and process it in a separate worker. |
| Multi-tenant design | Add tenant separation so each organisation sees only its own data, with tests. |
| Search engine | Index records in Elasticsearch, Meilisearch or Typesense and add fast search with filters. |
| Distributed tracing | Add OpenTelemetry tracing across your API and worker and view a trace. |
| Database backup and restore | Automate daily database backups and practise a restore to a new database. |
| Zero-downtime migration | Change a column in a way that never breaks running code (expand and contract). |
| Backend code review | Review a classmate's backend pull request for security, errors and performance. |
| Capstone 2: SaaS backend | Build a multi-tenant SaaS backend with billing-ready plans, roles, audit logs, background jobs, tests and deployment. |