skills.rest
DeltaFoundry850
DeltaFoundry850COMMUNITY
Explore all skills by this author →
GitHub

api-design-security

Implement secure admin APIs in Next.js 16 with RBAC, CSRF, and tenant isolation.

Updated Dec 26, 2025
Search Tags:#rbac#zod#csrf#audit-logging#admin-api#secure#tenant-isolation
One-click install
npx skills add https://github.com/DeltaFoundry850/crispy-fishstick --skill api-design-security-deltafoundry850
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-design-security
Source: https://github.com/DeltaFoundry850/crispy-fishstick/tree/main/.agent/skills/api-design-security
Command: npx skills add https://github.com/DeltaFoundry850/crispy-fishstick --skill api-design-security-deltafoundry850

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secure admin APIs by enforcing RBAC, CSRF protection, tenant isolation, and robust audit logging, reducing risk of data exposure and unauthorized access.

Core Features & Use Cases

  • Wrapped security patterns: Use adminRead for reads and adminMutation for mutations to automatically enforce RBAC, CSRF, audits, and rate limiting.
  • Tenant isolation: Ensure multi-tenant data access is scoped to the current user.
  • Audit logging & safe data handling: Redact sensitive fields and record before/after states for mutations.

Quick Start

Implement a secure admin API route using the recommended wrappers and a Zod schema to validate input.

Frequently Asked Questions about api-design-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement RBAC and tenant isolation for secure admin APIs in Next.js?▼

Implement secure admin APIs in Next.js 16 using adminRead and adminMutation wrappers to automatically enforce RBAC, tenant isolation, and rate limiting across your routes.

How do I add CSRF protection and audit logging to admin API routes?▼

Add CSRF protection and audit logging by wrapping routes with adminMutation, which automatically records before and after states while redacting sensitive fields for mutations.

What is the best way to validate input and handle errors in a multi-tenant admin API?▼

The best way to validate input in a multi-tenant admin API is using Zod schemas combined with robust error handling to ensure safe data selection and prevent data exposure.

Can I enforce rate limiting and multi-tenant data access on read routes in Next.js 16?▼

Yes, you can enforce rate limiting and multi-tenant data access on read routes by using the adminRead wrapper to scope data access to the current user automatically.

When do I need to redact sensitive fields during admin API audit logging?▼

You need to redact sensitive fields during audit logging whenever handling admin mutations to ensure robust security and prevent unauthorized data exposure in before and after states.

Related Skills

Explore More Software Engineering Skills→
dthompsonfldthompsonfl

api-design-security

Enforce RBAC, CSRF protection, tenant isolation, and audit logging in Next.js 16 admin APIs.

Community
Advanced
aws-samplesaws-samples
90

file-processing

Process and analyze CSV, JSON, and text data files with automated cleaning and transformation.

Official
Advanced
fcalellfcalell

multi-tenancy

Enforce tenant isolation and RBAC with authorization middleware and query guards.

Community
Advanced
Ai-WhisperersAi-Whisperers

nextjs-security

Harden Next.js 15 apps with CSRF protection, rate limiting, and RLS policies.

Official
Advanced