backend_api

Use Zod to define a schema describing the expected shape of the request body, then parse incoming data against it. Zod returns typed, validated data and rejects invalid input with detailed errors, and z.infer generates the matching TypeScript type.

Keep controllers limited to HTTP request and response handling, place all business logic in a reusable service layer, and abstract database access into a data access layer. This separation prevents SQL or ORM code from leaking into controllers.

Apply Helmet middleware to set standard security headers and express-rate-limit to throttle requests, for example 100 requests per 15-minute window. Combine these with proper CORS configuration and JWT authentication on protected routes.

Return 200 for successful GET and PATCH, 201 for created resources, 204 for deletions, 400 for validation errors, 401 for missing authentication, 403 for forbidden access, 404 for missing resources, and 429 for rate limiting.

Use api-design when planning API contracts or working with GraphQL, and use backend_api during actual implementation of REST endpoints. The backend_api skill focuses on coding-time concerns like validation, middleware, and response formatting.