Backend

Enforce error handling, validation, timeouts, and observability for REST backends.

Updated Feb 26, 2026
One-click install
npx skills add https://github.com/gabi-agent/openretro --skill backend-gabi-agent
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: Backend
Source: https://github.com/gabi-agent/openretro/tree/main/skills/backend
Command: npx skills add https://github.com/gabi-agent/openretro --skill backend-gabi-agent

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Backend systems often suffer from unpredictable failures, security gaps, and poor observability. This Skill provides a comprehensive set of practices to ensure reliable, secure, and observable services across modern architectures.

Core Features & Use Cases

  • Error Handling: never expose stack traces to clients—log internally, return generic message; structured error responses: code, message, request ID; fail fast on bad input; unexpected errors: 500 + alert
  • Input Validation: validate everything from outside—query params, headers, body, path params; whitelist valid input; validate early; size limits on all inputs
  • Timeouts Everywhere: set timeouts for database queries, external calls, overall request timeout, and background jobs
  • Retry Patterns: exponential backoff with jitter; idempotency keys; circuit breaker
  • Database Practices: connection pooling; transactions scoped minimal; read replicas; prepared statements
  • Caching Strategy: TTL; per-layer caching; cache stampede prevention; monitor hit rate
  • Rate Limiting: per-user/IP limits; different limits; Retry-After; early in request pipeline
  • Health Checks: liveness, readiness, startup probe; fast and cheap checks
  • Graceful Shutdown: stop accepting new requests; drain; close connections; handle signals
  • Logging: structured logs; request ID; appropriate log levels; avoid logging sensitive data
  • API Design: versioning; pagination; consistent response format; meaningful status codes
  • Security Hygiene: secrets handling; dependencies updates; least privilege; separate authn/authz
  • Observability: metrics, tracing, alerting, dashboards

Quick Start

Implement these backend best practices in your API to improve reliability, security, and observable performance.

Frequently Asked Questions about Backend

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement robust error handling in REST APIs to prevent exposing stack traces?

Robust error handling in REST APIs requires logging stack traces internally while returning generic messages to clients. Implement structured error responses containing code, message, and request ID, failing fast on bad input and alerting on unexpected 500 errors.

What is the best way to validate input parameters in microservice backends?

Input validation in microservice backends should validate everything from outside early, including query params, headers, body, and path params. Whitelist valid input and enforce strict size limits on all inputs to prevent bad data from processing.

How do I configure timeouts and retry patterns for database queries and external calls?

Timeouts for database queries and external calls require deterministic limits set across the entire request pipeline and background jobs. Configure retry patterns using exponential backoff with jitter, idempotency keys, and circuit breakers to prevent cascading failures.

Does this backend reliability guidance apply to microservices and distributed architectures?

Yes, this backend reliability guidance applies to REST and microservice backends across modern architectures. It enforces secure, scalable services by standardizing database connection pooling, cache stampede prevention, rate limiting, and comprehensive observability.

Why do I need liveness and readiness health checks for graceful shutdowns?

Liveness, readiness, and startup probes ensure fast, cheap health checks during graceful shutdowns. Graceful shutdowns stop accepting new requests, drain existing connections, and handle signals properly to maintain service stability during deployments.

What are the limitations of relying solely on structured logging for backend observability?

Structured logging alone provides limited backend observability without metrics, tracing, and alerting. Comprehensive observability requires combining structured logs with request IDs, distributed tracing, dashboards, and monitoring to fully secure and scale services.