API Patterns
API design decisions tied to the consumers and deployment constraints.
Learn to THINK, not copy fixed patterns.
🎯 Selective Reading Rule
Read ONLY files relevant to the request! Check the content map, find what you need.
📑 Content Map
| File |
Description |
When to Read |
api-style.md |
REST vs GraphQL vs tRPC decision tree |
Choosing API type |
rest.md |
Resource naming, HTTP methods, status codes |
Designing REST API |
response.md |
Envelope pattern, error format, pagination |
Response structure |
graphql.md |
Schema design, when to use, security |
Considering GraphQL |
trpc.md |
TypeScript monorepo, type safety |
TS fullstack projects |
versioning.md |
URI/Header/Query versioning |
API evolution planning |
auth.md |
JWT, OAuth, Passkey, API Keys |
Auth pattern selection |
rate-limiting.md |
Token bucket, sliding window |
API protection |
documentation.md |
OpenAPI/Swagger best practices |
Documentation |
security-testing.md |
OWASP API Top 10, auth/authz testing |
Security audits |
🔗 Related Skills
| Need |
Skill |
| API implementation |
@[skills/backend-architect] |
| Data structure |
@[skills/database-design] |
| Security details |
@[skills/api-security-best-practices] |
✅ Decision Checklist
Before designing an API:
❌ Anti-Patterns
DON'T:
- Default to REST for everything
- Use verbs in REST endpoints (/getUsers)
- Return inconsistent response formats
- Expose internal errors to clients
- Skip rate limiting
DO:
- Choose API style based on context
- Ask about client requirements
- Document thoroughly
- Use appropriate status codes
Script
| Script |
Purpose |
Command |
scripts/api_validator.py |
Local heuristic source scan (not schema validation) |
python3 skills/api-patterns/scripts/api_validator.py <project_path> |
When to Use
Use when defining a new endpoint contract, selecting REST/GraphQL/tRPC for known consumers, or changing pagination, errors, authentication or compatibility behavior. For a bug inside an existing contract, preserve that contract unless the task authorizes a change.
Inputs and procedure
Record consumers and deployed versions, expected payload size, access rules, compatibility obligations and one concrete operation. Read the relevant files in the map, compare the realistic choices, then specify request/response examples and rejection cases. Types shared at build time do not ensure that independently deployed clients remain compatible.
Worked example
Input: a public order list changes while clients page through it. Choose a bounded page size and cursor over a stable (created_at, id) order. Define the next-cursor format, authorization filter and behavior for a removed record or invalid cursor. Test two equal timestamps and an insertion between pages. Expected: no duplicate IDs within the promised snapshot semantics; document whether newly inserted rows can appear.
Limitations
- The Python helper scans at most 15 matching files using regular expressions and shallow JSON/YAML checks. Its output is a triage hint, not OpenAPI validation, an authorization audit or deployment approval.
- GraphQL query shape, tRPC inference and HTTP method names do not enforce resource authorization or backwards compatibility.
- Rate limiting cannot alone prevent all resource exhaustion; size, concurrency, time and provider-cost bounds depend on the operation.
- Perform security checks only against authorized local/test targets with isolated accounts and a defined scope.
1---2name: api-patterns3description: API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.4---5
6# API Patterns
7
8> API design decisions tied to the consumers and deployment constraints.
9> **Learn to THINK, not copy fixed patterns.**
10
11## 🎯 Selective Reading Rule
12
13**Read ONLY files relevant to the request!** Check the content map, find what you need.
14
15---
16
17## 📑 Content Map
18
19| File | Description | When to Read |
20|------|-------------|--------------|
21| `api-style.md` | REST vs GraphQL vs tRPC decision tree | Choosing API type |
22| `rest.md` | Resource naming, HTTP methods, status codes | Designing REST API |
23| `response.md` | Envelope pattern, error format, pagination | Response structure |
24| `graphql.md` | Schema design, when to use, security | Considering GraphQL |
25| `trpc.md` | TypeScript monorepo, type safety | TS fullstack projects |
26| `versioning.md` | URI/Header/Query versioning | API evolution planning |
27| `auth.md` | JWT, OAuth, Passkey, API Keys | Auth pattern selection |
28| `rate-limiting.md` | Token bucket, sliding window | API protection |
29| `documentation.md` | OpenAPI/Swagger best practices | Documentation |
30| `security-testing.md` | OWASP API Top 10, auth/authz testing | Security audits |
31
32---
33
34## 🔗 Related Skills
35
36| Need | Skill |
37|------|-------|
38| API implementation | `@[skills/backend-architect]` |
39| Data structure | `@[skills/database-design]` |
40| Security details | `@[skills/api-security-best-practices]` |
41
42---
43
44## ✅ Decision Checklist
45
46Before designing an API:
47
48- [ ] **Asked user about API consumers?**
49- [ ] **Chosen API style for THIS context?** (REST/GraphQL/tRPC)
50- [ ] **Defined consistent response format?**
51- [ ] **Planned versioning strategy?**
52- [ ] **Considered authentication needs?**
53- [ ] **Planned rate limiting?**
54- [ ] **Documentation approach defined?**
55
56---
57
58## ❌ Anti-Patterns
59
60**DON'T:**
61- Default to REST for everything
62- Use verbs in REST endpoints (/getUsers)
63- Return inconsistent response formats
64- Expose internal errors to clients
65- Skip rate limiting
66
67**DO:**
68- Choose API style based on context
69- Ask about client requirements
70- Document thoroughly
71- Use appropriate status codes
72
73---
74
75## Script
76
77| Script | Purpose | Command |
78|--------|---------|---------|
79| `scripts/api_validator.py` | Local heuristic source scan (not schema validation) | `python3 skills/api-patterns/scripts/api_validator.py <project_path>` |
80
81## When to Use
82
83Use when defining a new endpoint contract, selecting REST/GraphQL/tRPC for known consumers, or changing pagination, errors, authentication or compatibility behavior. For a bug inside an existing contract, preserve that contract unless the task authorizes a change.
84
85## Inputs and procedure
86
87Record consumers and deployed versions, expected payload size, access rules, compatibility obligations and one concrete operation. Read the relevant files in the map, compare the realistic choices, then specify request/response examples and rejection cases. Types shared at build time do not ensure that independently deployed clients remain compatible.
88
89## Worked example
90
91Input: a public order list changes while clients page through it. Choose a bounded page size and cursor over a stable `(created_at, id)` order. Define the next-cursor format, authorization filter and behavior for a removed record or invalid cursor. Test two equal timestamps and an insertion between pages. Expected: no duplicate IDs within the promised snapshot semantics; document whether newly inserted rows can appear.
92
93## Limitations
94
95- The Python helper scans at most 15 matching files using regular expressions and shallow JSON/YAML checks. Its output is a triage hint, not OpenAPI validation, an authorization audit or deployment approval.
96- GraphQL query shape, tRPC inference and HTTP method names do not enforce resource authorization or backwards compatibility.
97- Rate limiting cannot alone prevent all resource exhaustion; size, concurrency, time and provider-cost bounds depend on the operation.
98- Perform security checks only against authorized local/test targets with isolated accounts and a defined scope.
sickn33