WHEN to auto-invoke: Creating API routes, building endpoints, adding route.ts files, implementing REST/GraphQL APIs, adding authentication to APIs, rate limiting, API validation with Zod, handling HTTP methods (GET/POST/PUT/DELETE). WHEN NOT to invoke: Pure frontend work, styling, React components without API calls, documentation-only tasks, database migrations without API changes.
Production-grade FastAPI development with async patterns, Pydantic v2, dependency injection, ML/AI endpoint design, and modern Python best practices for building high-performance REST APIs
API Gateway patterns for routing, authentication, rate limiting, and service composition in microservices architectures. Use when implementing API gateways, building BFF layers, or managing service-to-service communication at scale.
Comprehensive API design patterns covering REST, GraphQL, gRPC, versioning, authentication, and modern API best practices
Type-safe API route handler with automatic Zod validation for Next.js App Router...
Router for documentation tasks - routes to ADRs, APIs, runbooks, security docs, or governance docs
Use when creating types, constants, Zod schemas, or working with data validation. Covers common-types package organization, runtime validation, and type guards across microservices.
Hono request validation with Zod, TypeBox, Valibot - type-safe input validation for JSON, forms, query params, and headers
Manage authentication and user operations in Supabase. Use for sign up, sign in, sign out, password resets, and user management.
Use when building web APIs, backend services, or encountering FastAPI/Django/Express/GraphQL questions, microservices architecture, authentication, or message queues - routes to 11 specialist skills rather than giving surface-level generic advice
Generates Postman collection JSON files from Express, Next.js, Fastify, Hono, or other API routes. Scans route definitions, extracts endpoints, methods, params, and creates importable collections. Use when users request "generate postman collection", "export to postman", "create postman file", or "postman import".
Use when analyzing REST/GraphQL API endpoints, contracts, authentication, and client-facing interfaces
Implements rate limiting and abuse prevention with per-route policies, IP/user-based limits, sliding windows, safe error responses, and observability. Use when adding "rate limiting", "API protection", "abuse prevention", or "DDoS protection".
Creates consistent error handling with custom error classes, HTTP status mapping, structured logging, safe client messages, and error taxonomy. Use when standardizing "error handling", "logging", "error responses", or "exception management".
Implement secure, comprehensive input validation on both client and server sides using allowlists, type checking, and sanitization to prevent injection attacks. Use this skill when handling user input from forms, API requests, or any external data source. When implementing form validation logic with field-specific error messages. When validating data types, formats, ranges, and required fields. When sanitizing input to prevent SQL injection, XSS, or command injection. When validating business rules like sufficient balance or valid date ranges. When implementing both client-side validation for user experience and mandatory server-side validation for security.
Design and implement RESTful API endpoints following REST principles, consistent naming conventions, and proper HTTP methods. Use this skill when creating or modifying API routes, controllers, or handlers in backend code. When implementing endpoint logic that handles HTTP requests (GET, POST, PUT, PATCH, DELETE). When working with API versioning, query parameters, or response formatting. When defining URL structures for resource-based endpoints. When setting up rate limiting or HTTP status code handling. When working with files like route definitions, controller files, API handler modules, or web framework configuration files.
RESTful and GraphQL API design expert covering best practices, security, and scalability
REST API design patterns for SpecFlux. Use when creating new API endpoints, designing request/response schemas, implementing pagination, or updating OpenAPI specifications. Follows Domain-Driven Design with specs organized by domain.
REST, GraphQL, and API design best practices. Use when designing APIs, defining contracts, or reviewing API architecture.
Validate JSON data against JSON Schema specifications. Use for API validation, config file validation, or data quality checks.
