api-patterns

Q: How do I install api-patterns?

Run npx skills add https://github.com/sickn33/agentic-awesome-skills --skill api-patterns in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/api-patterns/ (personal) or .claude/skills/api-patterns/ (project).

by sickn33Backend & APIs

API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.

Installs: 1.4K
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/sickn33/agentic-awesome-skills --skill api-patterns

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads api-patterns automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

API Patterns

API design decisions tied to the consumers and deployment constraints. Learn to THINK, not copy fixed patterns.

🎯 Selective Reading Rule

Read ONLY files relevant to the request! Check the content map, find what you need.

📑 Content Map

File	Description	When to Read
`api-style.md`	REST vs GraphQL vs tRPC decision tree	Choosing API type
`rest.md`	Resource naming, HTTP methods, status codes	Designing REST API
`response.md`	Envelope pattern, error format, pagination	Response structure
`graphql.md`	Schema design, when to use, security	Considering GraphQL
`trpc.md`	TypeScript monorepo, type safety	TS fullstack projects
`versioning.md`	URI/Header/Query versioning	API evolution planning
`auth.md`	JWT, OAuth, Passkey, API Keys	Auth pattern selection
`rate-limiting.md`	Token bucket, sliding window	API protection
`documentation.md`	OpenAPI/Swagger best practices	Documentation
`security-testing.md`	OWASP API Top 10, auth/authz testing	Security audits

🔗 Related Skills

Need	Skill
API implementation	`@[skills/backend-architect]`
Data structure	`@[skills/database-design]`
Security details	`@[skills/api-security-best-practices]`

✅ Decision Checklist

Before designing an API:

Asked user about API consumers?
Chosen API style for THIS context? (REST/GraphQL/tRPC)
Defined consistent response format?
Planned versioning strategy?
Considered authentication needs?
Planned rate limiting?
Documentation approach defined?

❌ Anti-Patterns

DON'T:

Default to REST for everything
Use verbs in REST endpoints (/getUsers)
Return inconsistent response formats
Expose internal errors to clients
Skip rate limiting

DO:

Choose API style based on context
Ask about client requirements
Document thoroughly
Use appropriate status codes

Script

Script	Purpose	Command
`scripts/api_validator.py`	Local heuristic source scan (not schema validation)	`python3 skills/api-patterns/scripts/api_validator.py <project_path>`

When to Use

Use when defining a new endpoint contract, selecting REST/GraphQL/tRPC for known consumers, or changing pagination, errors, authentication or compatibility behavior. For a bug inside an existing contract, preserve that contract unless the task authorizes a change.

Inputs and procedure

Record consumers and deployed versions, expected payload size, access rules, compatibility obligations and one concrete operation. Read the relevant files in the map, compare the realistic choices, then specify request/response examples and rejection cases. Types shared at build time do not ensure that independently deployed clients remain compatible.

Worked example

Input: a public order list changes while clients page through it. Choose a bounded page size and cursor over a stable (created_at, id) order. Define the next-cursor format, authorization filter and behavior for a removed record or invalid cursor. Test two equal timestamps and an insertion between pages. Expected: no duplicate IDs within the promised snapshot semantics; document whether newly inserted rows can appear.

Limitations

The Python helper scans at most 15 matching files using regular expressions and shallow JSON/YAML checks. Its output is a triage hint, not OpenAPI validation, an authorization audit or deployment approval.
GraphQL query shape, tRPC inference and HTTP method names do not enforce resource authorization or backwards compatibility.
Rate limiting cannot alone prevent all resource exhaustion; size, concurrency, time and provider-cost bounds depend on the operation.
Perform security checks only against authorized local/test targets with isolated accounts and a defined scope.

FAQ

What does the api-patterns skill do?

API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.

How do I install api-patterns?

Run npx skills add https://github.com/sickn33/agentic-awesome-skills --skill api-patterns in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/api-patterns/ (personal) or .claude/skills/api-patterns/ (project).

Which AI agents can use api-patterns?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is api-patterns safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains api-patterns?

It is published by sickn33 in sickn33/agentic-awesome-skills. It has 1,402 recorded installs.