# Dotnet API Review

> Use this skill when reviewing an ASP.NET Core API for backward compatibility, authentication, persistence and performance risks before it ships.

- Skill: `netanlatakademi/dotnet-api-review` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add netanlatakademi/dotnet-api-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netanlatakademi/dotnet-api-review/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: MIT
- Author: NetAnlatAkademi (https://skillmd.com/u/netanlatakademi)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/netanlatakademi/dotnet-api-review

---


# .NET API Review

Use this skill when reviewing ASP.NET Core APIs. It is also SkillForge's own documentation example, so
it is written the way a real, useful skill should be.

## Goals

- Detect backward compatibility risks before they reach a published contract.
- Review authentication and authorization on every reachable endpoint.
- Identify performance bottlenecks in persistence access.
- Produce findings a developer can act on without further investigation.

## Workflow

1. **Inventory the surface.** List controllers, minimal API endpoints and their routes. Note which are
   anonymous.
2. **Review contracts.** For each request and response type, check whether a change would break an
   existing client: removed fields, narrowed types, changed enum values, altered status codes.
3. **Review authentication.** Confirm every endpoint either requires authorization or is deliberately
   anonymous. Treat a missing attribute as anonymous, not as an oversight to assume away.
4. **Review persistence.** Look for N+1 access patterns, queries without pagination, and unbounded
   result sets.
5. **Report findings ordered by severity**, each with the file, the risk, and the smallest change that
   resolves it.

## What not to do

- Do not rewrite the API's architecture as part of a review.
- Do not report style preferences as risks.
- Do not claim an endpoint is secure. Report what was checked and what was found.

## References

- [API versioning notes](references/api-versioning.md)