Build production-ready REST API endpoints with validation

This skill builds complete, production-ready REST API endpoints for Express- or Fastify-style Node.js backends, covering route handlers with the correct HTTP method, input validation on body/params/query, authentication and authorization checks, business logic, error handling, response formatting, API documentation, and tests when requested. It follows a fixed response shape - {success, data} for success, {error, details} for errors, and a {success, data, pagination} envelope (page, limit, total, pages) for paginated lists - and maps outcomes to standard HTTP status codes: 200/201/204 for success, 400/401/403/404/409 for client errors, and 500 for server errors. The build is guided by a fixed set of principles: validate all inputs before processing, use the proper HTTP status code for each outcome, handle errors gracefully instead of letting them leak, never expose sensitive data such as passwords, keep response shapes consistent across endpoints, add authentication where the route needs it, document the endpoint, and write tests for the critical paths.

Use it when asked to "create an API endpoint" or "build a REST API," when building new backend features, adding endpoints to an existing API, or creating CRUD operations - anywhere the request mentions "API," "endpoint," "route," or "REST." Its own limitations restrict it to tasks that clearly match this scope, and it does not substitute for environment-specific validation, testing, or expert review; if required inputs, permissions, safety boundaries, or success criteria are missing, it stops and asks rather than guessing.

For a resource, a full CRUD set maps to:

// Create
POST /api/resources
Body: { name, description }

// Read (list)
GET /api/resources?page=1&limit=20

// Read (single)
GET /api/resources/:id

// Update
PUT /api/resources/:id
Body: { name, description }

// Delete
DELETE /api/resources/:id

List endpoints accept page and limit query params and return the results alongside a pagination object (page, limit, total, pages); filtering and sorting are supported through additional query params such as status and sort.

It composes with three related skills rather than duplicating their job: @security-auditor for a security review of the generated endpoint, @test-driven-development for writing the tests, and @database-design for the underlying data modeling. Its own security checklist covers authentication on protected routes, authorization checks that a user owns the resource being accessed, input validation on all fields, parameterized queries to prevent SQL injection, rate limiting on public endpoints, no sensitive data such as passwords or tokens in responses, properly configured CORS, and request size limits, plus a centralized error handler that hides internal error details in production.

Backend developers building or extending REST APIs in Node.js (Express or Fastify) who want a consistent, security-conscious endpoint structure - validation, auth, error handling, response shape, docs, and tests - applied the same way on every new route instead of reinvented per endpoint.