jsonapi

Q: How do I install jsonapi?

Run npx skills add https://github.com/prowler-cloud/prowler --skill jsonapi in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/jsonapi/ (personal) or .claude/skills/jsonapi/ (project).

by prowler-cloudBackend & APIs

Strict JSON:API v1.1 specification compliance. Trigger: When creating or modifying API endpoints, reviewing API responses, or validating JSON:API compliance.

Installs: 125
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/prowler-cloud/prowler --skill jsonapi

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads jsonapi automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Use With django-drf

This skill focuses on spec compliance. For implementation patterns (ViewSets, Serializers, Filters), use django-drf skill together with this one.

Skill	Focus
`jsonapi`	What the spec requires (MUST/MUST NOT rules)
`django-drf`	How to implement it in DRF (code patterns)

When creating/modifying endpoints, invoke BOTH skills.

Before Implementing/Reviewing

ALWAYS validate against the latest spec before creating or modifying endpoints:

Option 1: Context7 MCP (Preferred)

If Context7 MCP is available, query the JSON:API spec directly:

mcp_context7_resolve-library-id(query="jsonapi specification")
mcp_context7_query-docs(libraryId="<resolved-id>", query="[specific topic: relationships, errors, etc.]")

Option 2: WebFetch (Fallback)

If Context7 is not available, fetch from the official spec:

WebFetch(url="https://jsonapi.org/format/", prompt="Extract rules for [specific topic]")

This ensures compliance with the latest JSON:API version, even after spec updates.

Critical Rules (NEVER Break)

Document Structure

NEVER include both data and errors in the same response
ALWAYS include at least one of: data, errors, meta
ALWAYS use type and id (string) in resource objects
NEVER include id when creating resources (server generates it)

Content-Type

ALWAYS use Content-Type: application/vnd.api+json
ALWAYS use Accept: application/vnd.api+json
NEVER add parameters to media type without ext/profile

Resource Objects

ALWAYS use string for id (even if UUID)
ALWAYS use lowercase kebab-case for type
NEVER put id or type inside attributes
NEVER include foreign keys in attributes - use relationships

Relationships

ALWAYS include at least one of: links, data, or meta
ALWAYS use resource linkage format: {"type": "...", "id": "..."}
NEVER use raw IDs in relationships - always use linkage objects

Error Objects

ALWAYS return errors as array: {"errors": [...]}
ALWAYS include status as string (e.g., "400", not 400)
ALWAYS include source.pointer for field-specific errors

HTTP Status Codes (Mandatory)

Operation	Success	Async	Conflict	Not Found	Forbidden	Bad Request
GET	`200`	-	-	`404`	`403`	`400`
POST	`201`	`202`	`409`	`404`	`403`	`400`
PATCH	`200`	`202`	`409`	`404`	`403`	`400`
DELETE	`200`/`204`	`202`	-	`404`	`403`	-

When to Use Each

Code	Use When
`200 OK`	Successful GET, PATCH with response body, DELETE with response
`201 Created`	POST created resource (MUST include `Location` header)
`202 Accepted`	Async operation started (return task reference)
`204 No Content`	Successful DELETE, PATCH with no response body
`400 Bad Request`	Invalid query params, malformed request, unknown fields
`403 Forbidden`	Authentication ok but no permission, client-generated ID rejected
`404 Not Found`	Resource doesn't exist OR RLS hides it (never reveal which)
`409 Conflict`	Duplicate ID, type mismatch, relationship conflict
`415 Unsupported`	Wrong Content-Type header

Document Structure

Success Response (Single)

{
  "data": {
    "type": "providers",
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "attributes": {
      "alias": "Production",
      "connected": true
    },
    "relationships": {
      "tenant": {
        "data": {"type": "tenants", "id": "..."}
      }
    },
    "links": {
      "self": "/api/v1/providers/550e8400-..."
    }
  },
  "links": {
    "self": "/api/v1/providers/550e8400-..."
  }
}

Success Response (List)

{
  "data": [
    {"type": "providers", "id": "...", "attributes": {...}},
    {"type": "providers", "id": "...", "attributes": {...}}
  ],
  "links": {
    "self": "/api/v1/providers?page[number]=1",
    "first": "/api/v1/providers?page[number]=1",
    "last": "/api/v1/providers?page[number]=5",
    "prev": null,
    "next": "/api/v1/providers?page[number]=2"
  },
  "meta": {
    "pagination": {"count": 100, "pages": 5}
  }
}

Error Response

{
  "errors": [
    {
      "status": "400",
      "code": "invalid",
      "title": "Invalid attribute",
      "detail": "UID must be 12 digits for AWS accounts",
      "source": {"pointer": "/data/attributes/uid"}
    }
  ]
}

Query Parameters

Family	Format	Example
`page`	`page[number]`, `page[size]`	`?page[number]=2&page[size]=25`
`filter`	`filter[field]`, `filter[field__op]`	`?filter[status]=FAIL`
`sort`	Comma-separated, `-` for desc	`?sort=-inserted_at,name`
`fields`	`fields[type]`	`?fields[providers]=id,alias`
`include`	Comma-separated paths	`?include=provider,scan.task`

Rules

MUST return 400 for unsupported query parameters
MUST return 400 for unsupported include paths
MUST return 400 for unsupported sort fields
MUST NOT include extra fields when fields[type] is specified

Common Violations (AVOID)

Violation	Wrong	Correct
ID as integer	`"id": 123`	`"id": "123"`
Type as camelCase	`"type": "providerGroup"`	`"type": "provider-groups"`
FK in attributes	`"tenant_id": "..."`	`"relationships": {"tenant": {...}}`
Errors not array	`{"error": "..."}`	`{"errors": [{"detail": "..."}]}`
Status as number	`"status": 400`	`"status": "400"`
Data + errors	`{"data": ..., "errors": ...}`	Only one or the other
Missing pointer	`{"detail": "Invalid"}`	`{"detail": "...", "source": {"pointer": "..."}}`

Relationship Updates

To-One Relationship

PATCH /api/v1/providers/123/relationships/tenant
Content-Type: application/vnd.api+json

{"data": {"type": "tenants", "id": "456"}}

To clear: {"data": null}

To-Many Relationship

Operation	Method	Body
Replace all	PATCH	`{"data": [{...}, {...}]}`
Add members	POST	`{"data": [{...}]}`
Remove members	DELETE	`{"data": [{...}]}`

Compound Documents (`include`)

When using ?include=provider:

{
  "data": {
    "type": "scans",
    "id": "...",
    "relationships": {
      "provider": {
        "data": {"type": "providers", "id": "prov-123"}
      }
    }
  },
  "included": [
    {
      "type": "providers",
      "id": "prov-123",
      "attributes": {"alias": "Production"}
    }
  ]
}

Rules

Every included resource MUST be reachable via relationship chain from primary data
MUST NOT include orphan resources
MUST NOT duplicate resources (same type+id)

Spec Reference

Full Specification: https://jsonapi.org/format/
Implementation: Use django-drf skill for DRF-specific patterns
Testing: Use prowler-test-api skill for test patterns

FAQ

What does the jsonapi skill do?

Strict JSON:API v1.1 specification compliance. Trigger: When creating or modifying API endpoints, reviewing API responses, or validating JSON:API compliance.

How do I install jsonapi?

Run npx skills add https://github.com/prowler-cloud/prowler --skill jsonapi in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/jsonapi/ (personal) or .claude/skills/jsonapi/ (project).

Which AI agents can use jsonapi?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is jsonapi safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains jsonapi?

It is published by prowler-cloud in prowler-cloud/prowler. It has 125 recorded installs.

More from prowler-cloud/prowler

View all →

zod-4

prowler-cloud/prowler

Zod 4 schema validation patterns. Trigger: When creating or updating Zod v4 schemas for validation/parsing (forms, request payloads, adapters), including v3 - v4 migration patterns.

Code Quality & Workflow1.2K installs

zustand-5

prowler-cloud/prowler

Zustand 5 state management patterns. Trigger: When implementing client-side state with Zustand (stores, selectors, persist middleware, slices).

911 installs

react-19

prowler-cloud/prowler

React 19 patterns with React Compiler. Trigger: When writing React 19 components/hooks in .tsx (React Compiler rules, hook patterns, refs as props). If using Next.js App Router/Server Actions, also use nextjs-16.

Frontend & Design671 installs

tailwind-4

prowler-cloud/prowler

Tailwind CSS 4 patterns and best practices. Trigger: When styling with Tailwind (className, variants, cn()), especially when dynamic styling or CSS variables are involved (no var() in className).

Frontend & Design612 installs

django-drf

prowler-cloud/prowler

Django REST Framework patterns. Trigger: When implementing generic DRF APIs (ViewSets, serializers, routers, permissions, filtersets). For Prowler API specifics (RLS/RBAC/Providers), also use prowler-api.

Backend & APIs482 installs

typescript

prowler-cloud/prowler

Open the skill to read its SKILL.md instructions.

Code Quality & Workflow253 installs

Popular backend & apis skills

View category →

find-skills

vercel-labs/skills

Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.

OfficialBackend & APIs4.1M installs

entra-app-registration

microsoft/azure-skills

Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.

OfficialBackend & APIs566.7K installs

google-agents-cli-adk-code

google/agents-cli

This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).

Backend & APIs514.8K installs

embedded-captions

heygen-com/hyperframes

Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.

Backend & APIs453.3K installs

entra-agent-id

microsoft/azure-skills

Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).

OfficialBackend & APIs336.6K installs

neon

neondatabase/agent-skills

Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.

Backend & APIs237.1K installs

jsonapi

Install

Install

Describe the task

Review the result

SKILL.md

Use With django-drf

Before Implementing/Reviewing

Option 1: Context7 MCP (Preferred)

Option 2: WebFetch (Fallback)

Critical Rules (NEVER Break)

Document Structure

Content-Type

Resource Objects

Relationships

Error Objects

HTTP Status Codes (Mandatory)

When to Use Each

Document Structure

Success Response (Single)

Success Response (List)

Error Response

Query Parameters

Rules

Common Violations (AVOID)

Relationship Updates

To-One Relationship

To-Many Relationship

Compound Documents (include)

Rules

Spec Reference

FAQ

More from prowler-cloud/prowler

Popular backend & apis skills

Compound Documents (`include`)