security-patterns

Implement JWT/OAuth2, RBAC/ABAC, and security controls for REST APIs.

1|Updated Nov 18, 2025
One-click install
npx skills add https://github.com/pluginagentmarketplace/custom-plugin-api-design --skill security-patterns-pluginagentmarketplace
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-patterns
Source: https://github.com/pluginagentmarketplace/custom-plugin-api-design/tree/main/skills/security-patterns
Command: npx skills add https://github.com/pluginagentmarketplace/custom-plugin-api-design --skill security-patterns-pluginagentmarketplace

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyyaml, and includes assets (resource) and scripts (resource) and references (resource) components.

What problem does it solve?

APIs require robust protection; this skill provides a comprehensive framework for API security including authentication, authorization, and compliance controls.

Core Features & Use Cases

  • Authentication patterns: JWT and OAuth2
  • Authorization patterns: RBAC and ABAC with policy evaluation
  • Security controls: rate limiting, security headers, input validation, and audit logging
  • Compliance support: GDPR/HIPAA mapping and data protection templates
  • Use Case: secure a microservice API gateway by enforcing token validation, scoped access, and centralized audit events
  • Use Case: apply consistent security headers and CSP across services

Quick Start

Apply a baseline security pattern to your API by specifying the target endpoints and the desired authentication method.

Frequently Asked Questions about security-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT authentication and RBAC authorization for a microservice API?

To implement JWT authentication and RBAC authorization for a microservice API, you can apply configurable security patterns using YAML files. This generates sample code that validates tokens, enforces scoped access, and evaluates role-based policies across your services.

What is the best way to enforce consistent security headers and rate limiting across REST APIs?

The best way to enforce security headers and rate limiting across REST APIs is by applying standardized security patterns through YAML configurations. This ensures consistent CSP enforcement and request throttling across all backend services.

Does this API security approach support ABAC policy evaluation alongside OAuth2?

Yes, this API security approach supports ABAC policy evaluation alongside OAuth2. You can configure attribute-based access control policies to evaluate user attributes and environmental conditions for fine-grained authorization.

How do I add audit logging and GDPR compliance controls to my backend API?

To add audit logging and GDPR compliance controls to your backend API, you apply specific security patterns that map data protection requirements. This generates templates for centralized audit events and compliance tracking.

Can I validate API security standards and input validation rules using scripts?

Yes, you can validate API security standards and input validation rules using included validation scripts. These scripts enforce your configured security guidelines and verify that input validation patterns are correctly applied.