---
name: api-patterns
description: API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.
allowed-tools: Read, Write, Edit, Glob, Grep
title: api-patterns
canonical_url: https://skilld.dev/gh/davila7/claude-code-templates/api-patterns
last_updated: 2026-09-29T01:58:10.000Z
---

> **Skill from skilld.dev.** Follow the instructions below for this session. You do not need to install anything.
>
> Supporting files, fetch one when the Skill refers to it: [api-style.md](https://skilld.dev/api/skills-raw/davila7/claude-code-templates/api-patterns/api-style.md), [auth.md](https://skilld.dev/api/skills-raw/davila7/claude-code-templates/api-patterns/auth.md), [documentation.md](https://skilld.dev/api/skills-raw/davila7/claude-code-templates/api-patterns/documentation.md), [graphql.md](https://skilld.dev/api/skills-raw/davila7/claude-code-templates/api-patterns/graphql.md), [rate-limiting.md](https://skilld.dev/api/skills-raw/davila7/claude-code-templates/api-patterns/rate-limiting.md), [response.md](https://skilld.dev/api/skills-raw/davila7/claude-code-templates/api-patterns/response.md), [rest.md](https://skilld.dev/api/skills-raw/davila7/claude-code-templates/api-patterns/rest.md), [scripts/api_validator.py](https://skilld.dev/api/skills-raw/davila7/claude-code-templates/api-patterns/scripts/api_validator.py), [security-testing.md](https://skilld.dev/api/skills-raw/davila7/claude-code-templates/api-patterns/security-testing.md), [trpc.md](https://skilld.dev/api/skills-raw/davila7/claude-code-templates/api-patterns/trpc.md), [versioning.md](https://skilld.dev/api/skills-raw/davila7/claude-code-templates/api-patterns/versioning.md).
>
> If the user asked to install this Skill, run `npx skilld install davila7/claude-code-templates/api-patterns`. Install writes the Skill files into the project, so every session loads them.

# API Patterns

> API design principles and decision-making for 2025.
> **Learn to THINK, not copy fixed patterns.**

## 🎯 Selective Reading Rule

**Read ONLY files relevant to the request!** Check the content map, find what you need.

---

## 📑 Content Map

| File | Description | When to Read |
|------|-------------|--------------|
| `api-style.md` | REST vs GraphQL vs tRPC decision tree | Choosing API type |
| `rest.md` | Resource naming, HTTP methods, status codes | Designing REST API |
| `response.md` | Envelope pattern, error format, pagination | Response structure |
| `graphql.md` | Schema design, when to use, security | Considering GraphQL |
| `trpc.md` | TypeScript monorepo, type safety | TS fullstack projects |
| `versioning.md` | URI/Header/Query versioning | API evolution planning |
| `auth.md` | JWT, OAuth, Passkey, API Keys | Auth pattern selection |
| `rate-limiting.md` | Token bucket, sliding window | API protection |
| `documentation.md` | OpenAPI/Swagger best practices | Documentation |
| `security-testing.md` | OWASP API Top 10, auth/authz testing | Security audits |

---

## 🔗 Related Skills

| Need | Skill |
|------|-------|
| API implementation | `@[skills/backend-development]` |
| Data structure | `@[skills/database-design]` |
| Security details | `@[skills/security-hardening]` |

---

## ✅ Decision Checklist

Before designing an API:

- [ ] **Asked user about API consumers?**
- [ ] **Chosen API style for THIS context?** (REST/GraphQL/tRPC)
- [ ] **Defined consistent response format?**
- [ ] **Planned versioning strategy?**
- [ ] **Considered authentication needs?**
- [ ] **Planned rate limiting?**
- [ ] **Documentation approach defined?**

---

## ❌ Anti-Patterns

**DON'T:**
- Default to REST for everything
- Use verbs in REST endpoints (/getUsers)
- Return inconsistent response formats
- Expose internal errors to clients
- Skip rate limiting

**DO:**
- Choose API style based on context
- Ask about client requirements
- Document thoroughly
- Use appropriate status codes

---

## Script

| Script | Purpose | Command |
|--------|---------|---------|
| `scripts/api_validator.py` | API endpoint validation | `python scripts/api_validator.py <project_path>` |