api-naming

Standardize API path prefixes by enforcing specific boundaries: use /api/v1 for public endpoints, /api/v1/admin for management routes, and <APIPrefix>/internal for internal domains. This clarifies intended audiences and prevents accidental exposure of internal plugin APIs.

API versioning requires prescribing a stable location for public APIs and introducing breaking changes through new versions. This approach eliminates unclear versioning and maintains compatibility across services while enforcing consistent versioning policies.

Tenant propagation for admin and internal API routes requires authentication and specifies tenant validation to prevent cross-tenant access. This mechanism enforces access boundaries and reduces security gaps across services.

OpenAPI exposure rules do not apply to all endpoints uniformly. The convention specifies exactly which endpoints must expose OpenAPI and outlines the tracing and audit metadata required for observability and compliance.

Audit service routes by comparing them against API naming and access rules to identify mismatches. Generate a list of inconsistencies with recommended fixes to align endpoints with path prefix, versioning, and authentication policies.

Reverse-proxy patterns support host plugin proxy paths and plugin internal endpoints. The convention documents these patterns with examples for plugin lifecycle and governance to ensure secure and standardized integration.