Use this skill when implementing or reviewing API endpoints.
Core Rules
- Keep transport concerns in router layers only.
- Keep business logic in package services.
- Use typed schemas at I/O boundaries.
- Map domain/application errors to stable HTTP responses.
- Ensure async-safe I/O boundaries.
- Add or adjust tests for success and failure paths.
Handler Shape
- Prefer explicit request/response models.
- Keep handlers orchestration-thin.
- Inject dependencies through providers/dependencies rather than in-handler construction.
Error Mapping
- Do not return raw internal result envelopes from routes.
- Normalize domain errors to consistent HTTP status codes and response detail shape.
- Log contextual, non-sensitive metadata for failures.
Forbidden Patterns
- Business logic directly in route handlers.
- Returning raw
OperationResultobjects from HTTP handlers. - Accessing
request.app.stateinside handlers when a dependency can be injected. - Broad exception catches that collapse distinct error classes.
Test Matrix (Minimum)
- Success response path with expected schema.
- Failure mapping path (at least one domain/application error).
- Dependency-driven path (auth/rate limit/permission branch where relevant).
OpenAPI Minimum Metadata
- Router includes exactly one tag.
- Route includes a clear summary and/or description.
- Route defines expected response mapping for non-2xx conditions.
- Public request/response fields include descriptions.
Source: cds-snc/sre-bot — distributed by TomeVault.