sf-api-design

Design secure, consistent Salesforce APIs with REST and SOAP endpoints.

13|2|Updated Mar 18, 2026
One-click install
npx skills add https://github.com/jiten-singh-shahi/salesforce-claude-code --skill sf-api-design
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: sf-api-design
Source: https://github.com/jiten-singh-shahi/salesforce-claude-code/tree/main/.cursor/skills/sf-api-design
Command: npx skills add https://github.com/jiten-singh-shahi/salesforce-claude-code --skill sf-api-design

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides concrete patterns and guardrails for designing inbound Salesforce APIs so integrators and developers avoid security mistakes, governor limit surprises, and inconsistent error handling that break clients and create operational risk.

Core Features & Use Cases

  • API structure & patterns: guidance for REST and SOAP endpoints, versioning, pagination, and batch operations so APIs remain maintainable and scalable.
  • Security & permissions: recommendations for CRUD/FLS enforcement, WITH USER_MODE, Security.stripInaccessible(), and authentication patterns (Named Principal, Per-User, JWT).
  • Error handling & responses: standardized response envelopes, structured error codes, and proper HTTP status usage that allow clients to programmatically react to failures.
  • Review & compliance: use when authoring or auditing Apex REST classes, building bulk endpoints, or defining integration contracts for external consumers.

Quick Start

Ask the skill to review an Apex REST class and produce a prioritized checklist of security, pagination, error-handling, and authentication improvements.

Frequently Asked Questions about sf-api-design

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I design secure Apex REST APIs in Salesforce?

To design secure Apex REST APIs in Salesforce, enforce CRUD/FLS using WITH USER_MODE and apply Security.stripInaccessible() to strip inaccessible fields, ensuring proper authentication patterns and field-level security for inbound integrations.

What is the best way to handle errors in Salesforce custom APIs?

Handling errors in Salesforce custom APIs requires standardized response envelopes with structured error codes and correct HTTP status handling, ensuring clients can programmatically react to integration failures consistently.

How do I avoid governor limits when building batch REST operations in Salesforce?

Avoiding governor limits when building batch REST operations in Salesforce requires implementing pagination and governor limit awareness patterns, ensuring batch endpoints process bulk data without hitting platform limits.

Does this approach work for Salesforce Composite API integrations and SOAP endpoints?

Yes, these API design patterns support Salesforce Composite API integrations and SOAP endpoints, providing versioning, authentication patterns like JWT, and structured error handling across Apex REST, SOAP, and batch operations.

When should I use Named Principal vs Per-User authentication for Salesforce API design?

Choosing Named Principal vs Per-User authentication for Salesforce API design depends on whether the integration acts as a shared service account or impersonates specific users, directly impacting CRUD/FLS enforcement and field-level stripping behavior.