# Make Mvc Restful API

> Generate or modify MVC RESTful APIs that return JSON responses. Use when Codex needs to scaffold or extend Model-View-Controller API projects with route controllers, request DTOs, response DTOs/resources, services, repositories, validation, database access, authentication/authorization, JSON error handling, pagination/filtering, OpenAPI-style documentation, Docker support, and tests across common web frameworks. Prefer this skill when the user explicitly asks for MVC plus REST, RESTful endpoints, API controllers, JSON responses, or a web service organized around model/controller/service/repository responsibilities; avoid using it for server-rendered views/templates unless the user asks for mixed MVC web pages.

- Skill: `b-holanda/make-mvc-restful-api` (Agent Skill, multi-file: 11 files)
- Install (CLI): `npx skillmds@latest add b-holanda/make-mvc-restful-api`
- Raw SKILL.md: https://api.skillmd.com/api/skills/b-holanda/make-mvc-restful-api/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: b-holanda (https://skillmd.com/u/b-holanda)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/b-holanda/make-mvc-restful-api

---


# Make MVC RESTful API

MVC for RESTful APIs keeps HTTP request handling, domain behavior, persistence, and JSON response shaping separate. The controller owns routing, binding, authorization checks, status codes, and response mapping. Models and services own business behavior. Repositories or data-access adapters own persistence. JSON response DTOs or resources form the API contract.

- **Model**: Owns domain data, invariants, value objects, persisted entities, and business rules.
- **Controller**: Receives HTTP input, validates/binds request data, calls services or use-case handlers, and returns JSON with explicit status codes.
- **Resource or Response DTO**: Presents data as the public JSON contract. It should not expose internal persistence objects by accident.
- **Service**: Coordinates use cases, transactions, policies, repositories, and external integrations.
- **Repository**: Encapsulates persistence queries and mappings when persistence details should stay out of controllers and services.

## Core Practices

1. **Design Endpoints Around Resources**: Use clear resource names, HTTP verbs, route parameters, query parameters, and status codes.
2. **Keep Controllers Thin**: Controllers should bind input, call application behavior, and map results to JSON responses.
3. **Use Request and Response DTOs**: Treat request bodies and JSON responses as contracts. Do not expose ORM entities directly.
4. **Validate at Boundaries**: Validate route params, query params, headers, and JSON bodies before calling services.
5. **Return Consistent Errors**: Map validation, not-found, conflict, authorization, rate-limit, and unexpected failures to predictable JSON error shapes.
6. **Use Services for Workflows**: Put multi-step use cases, transactions, authorization policy decisions, and side effects outside controllers.
7. **Use Repositories Deliberately**: Isolate persistence details when queries, mappings, or storage choices would otherwise leak into controllers.
8. **Support Pagination and Filtering Intentionally**: Make collection endpoints explicit about sorting, filtering, pagination, limits, and defaults.
9. **Secure by Default**: Add authentication, authorization, input validation, safe database access, secret management, CORS rules, and rate limiting where appropriate.
10. **Test the Contract**: Cover routing, validation, status codes, response bodies, authorization paths, repository behavior, and critical end-to-end flows.
11. **Externalize Configuration**: Keep environment-specific settings and secrets outside the codebase.
12. **Document the API Shape**: Document endpoints, DTOs, status codes, error shapes, auth requirements, environment variables, and deployment assumptions.

## API Fit Criteria

- **RESTful JSON APIs**: Best fit for services exposing HTTP resources consumed by web, mobile, CLI, or integration clients.
- **MVC-Organized Backends**: Best fit when the project uses controllers, models, services, repositories, DTOs, and framework routing.
- **CRUD and Workflow APIs**: Good for both simple resource operations and use-case endpoints that still benefit from clear request/response contracts.
- **Public or Team-Consumed APIs**: Useful when stable JSON contracts, documentation, validation, and error consistency matter.
- **Applications Expected to Grow**: Keeps controllers from accumulating persistence logic, business rules, and ad hoc response mapping.

## Reference Guides

- [Controller Guidelines](references/controller-guidelines.md)
- [API Response Guidelines](references/api-response-guidelines.md)
- [Model Binding Guidelines](references/model-binding-guidelines.md)
- [Service Layer Guidelines](references/service-layer-guidelines.md)
- [Repository Pattern Guidelines](references/repository-pattern-guidelines.md)
- [Database Guidelines](references/database-guidelines.md)
- [Testing Guidelines](references/testing-guidelines.md)
- [API Security Guidelines](references/api-security-guidelines.md)
- [Environment Variables Guidelines](references/environment-variables.md)
- [Docker Guidelines](references/docker-guidelines.md)