skills.rest
TECH-HY
TECH-HYOFFICIAL
Explore all skills by this author →
GitHub

tpo-api-design-standards

Defines API design standards, contract templates, and review checklists for technical product owners.

Updated Mar 22, 2026
Search Tags:#checklist#authorization#api design#rest api#api contract#api review#technical product owner
One-click install
npx skills add https://github.com/TECH-HY/SKILLS --skill tpo-api-design-standards-tech-hy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tpo-api-design-standards
Source: https://github.com/TECH-HY/SKILLS/tree/main/skills/tpo-api-design-standards
Command: npx skills add https://github.com/TECH-HY/SKILLS --skill tpo-api-design-standards-tech-hy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams often ship APIs with inconsistent naming, missing authorization rules, unsafe error messages, and undocumented pagination or versioning, leading to security gaps and integration friction. This Skill gives a Technical Product Owner agent a complete set of API design standards, contract templates, and review checklists to enforce consistency before implementation. ## Core Features & Use Cases - API Contract Template: Standardized markdown template covering endpoint, method, auth, parameters, request/response bodies, errors, idempotency, rate limits, and audit logging. - Security & Design Checklists: Verification rules for object-level authorization, safe error responses, rate limiting, webhook signature verification, and pagination. - Structured Review Output: A ready-to-use API review format with contract completeness, security review, consistency review, required fixes, and acceptance criteria. - Use Case: When planning a new projects API, the agent applies the resource naming rules, defines cursor pagination, requires object-level authorization on /projects/{projectId}, and produces a review document listing required fixes before development starts. ## Quick Start Review the attached API endpoint specification against the API design standards and produce a structured API review with required fixes.

Frequently Asked Questions about tpo-api-design-standards

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a complete API contract specification?▼

Use the API contract template covering endpoint, method, authentication, authorization, path and query parameters, request and response bodies, error responses, validation rules, idempotency, rate limits, audit logging, and tests. Every field must be explicitly defined before implementation.

What should an API design review checklist include?▼

An API review should verify contract completeness, authentication and object-level authorization, sensitive field protection, safe error messages, rate limits, naming consistency, response format, pagination, and versioning. It ends with required fixes and acceptance criteria.

When should an API use idempotency keys?▼

Idempotency keys are required for operations that may be retried, such as payment creation, billing updates, order creation, webhook processing, imports, notification dispatch, and AI generation requests that create persistent records.

Does this standard require object-level authorization on every endpoint?▼

Yes, object-level authorization is mandatory for any endpoint using user-controlled object IDs. For example, GET /projects/{projectId} must verify the caller is an owner, member, admin, or has explicit access, not just that they are logged in.

What API design mistakes should be rejected in review?▼

Reject designs with unclear resource ownership, action-heavy endpoints without reason, missing object-level authorization, exposed internal fields, error messages leaking internals, missing pagination for collections, missing rate limits on expensive endpoints, unclear versioning, and unverified webhooks.

Related Skills

Explore More Product & Management Skills→
Yukine5377Yukine5377

bmad-agent-pm

Guide user interviews and draft lean PRDs with traceable requirements.

Community
Intermediate
vibbsvibbs
6

api-tester-playbook

Generate API testing playbooks for contract, authentication, pagination, and error handling.

Community
Advanced
MaxGiu67MaxGiu67

bs-security

Identify security and privacy gaps in project artifacts and generate threat models and GDPR checklists.

Community
Intermediate
indrasvatindrasvat
3

api-compat

Detect breaking changes in protobuf, OpenAPI, GraphQL, and Go API definitions.

Community
Advanced