Build production-ready REST API endpoints with validation

This skill builds complete, production-ready REST API endpoints with validation, error handling, authentication and documentation. For each endpoint it produces a route handler with the proper HTTP method, input validation for the request body, params and query, authentication and authorization checks, business logic, error handling, response formatting, API documentation, and tests when requested.

The endpoint structure it teaches has three steps. First the route definition, shown for both Express and Fastify, where authentication and validation run before the handler. Second, input validation before any processing, for example rejecting a missing or malformed email, a name shorter than 2 characters and a password shorter than 8 characters with a 400 response. Third, the handler itself: check whether the user already exists and return 409 if so, hash the password with bcrypt, create the record, strip the password from the response, return 201 on success and a generic 500 on failure.

Best practices it lists:

• Status codes: 200 for GET, PUT and PATCH success, 201 for created, 204 for no content, 400 for validation failure, 401 for unauthenticated, 403 for unauthorized, 404 for not found, 409 for conflicts and 500 for internal errors.
• A consistent response format: success with data, an error with an optional details object, and lists with a pagination object holding page, limit and total.
• A centralized error handler that hides error details in production.
• A security checklist: authentication on protected routes, ownership checks, validation on all fields, parameterized queries against SQL injection, rate limiting on public endpoints, no passwords or tokens in responses, proper CORS and request size limits.

Use it when asked to create an API endpoint or build a REST API, when building backend features, adding endpoints to an existing API, adding CRUD operations, or when the request mentions API, endpoint, route or REST.

Use it only when the task matches this scope. Its output is not a substitute for environment-specific validation, testing or expert review. If required inputs, permissions, safety boundaries or success criteria are missing, stop and ask for clarification.

The input is a request for an endpoint or resource. The output is the handler code and its surrounding pieces. Common patterns covered are CRUD routes, pagination with page and limit and a computed page count, and filtering and sorting with a default sort of newest first. A documentation template uses route, description, access, body and returns tags with an example request. A Jest-style testing example uses supertest to check that a valid request returns 201 with no password in the body and that an invalid email returns 400.

GET /api/resources?page=1&limit=20

Key principles: validate all inputs before processing, use proper status codes, handle errors gracefully, never expose sensitive data, keep responses consistent, add authentication where needed, document endpoints and write tests for critical paths.

The examples use Express and Fastify routing, bcrypt for password hashing and a Jest-style test runner with supertest. It points to related skills for deeper work: @security-auditor for security review, @test-driven-development for testing and @database-design for data modeling.

Backend developers who need a repeatable pattern for building REST endpoints with validation, auth, error handling and documentation, and teams that want consistent response formats and a security checklist across their API.