REST and GraphQL API design principles, versioning, error handling, and documentation patterns

MITAuto-check passedBackend & APIs

Install API Design

skills CLI
$ npx skills add cosmicstack-labs/mercury-agent-skills --skill api-design -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install cosmicstack-labs/mercury-agent-skills api-design --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/cosmicstack-labs/mercury-agent-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/categories/backend/api-design .claude/skills/api-design && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
api-design
GitHub stars
476
Token cost
~1.9k tokens
SKILL.md length
580 words
Files
1
Skills in repo
12
Repo updated
First seen
Licence
MIT

At a glance

REST and GraphQL API design principles, versioning, error handling, and documentation patterns

  • Works in 4 steps: Consistency Over Cleverness → Resources, Not Actions → Developer Experience First → …
  • Tasks that involve API design
  • SKILL.md covers Core Principles, API Quality Scorecard, Actionable Guidance and Common Mistakes
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

API Design is an agent skill from cosmicstack-labs/mercury-agent-skills. REST and GraphQL API design principles, versioning, error handling, and documentation patterns

Its SKILL.md is about 1.9k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering API design and GraphQL. It works with GraphQL. The repository describes itself as: A curated registry of reusable Mercury Agent, Open Claw or Hermes Agent skills designed for real developer workflows, persistent memory, and token-efficient execution. The licence is MIT.

When your agent uses it

  • Tasks that involve API design
  • Tasks that involve GraphQL

Example prompts

  • “/api-design”

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Consistency Over Cleverness
  2. Resources, Not Actions
  3. Developer Experience First
  4. Backward Compatibility

What it can do on your machine

Read from SKILL.md and the folder at commit 30392fb. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are json, graphql and yaml).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

API Design loads about 1.9k tokens when it runs. Until then it costs about 26 tokens; SKILL.md has 580 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~26
When it runs · the whole SKILL.md, loaded when a task matches
~1.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from cosmicstack-labs/mercury-agent-skills at commit 30392fb, republished under its MIT licence (© cosmicstack-labs). 580 words, ~1,914 tokens.

Download SKILL.mdSave it as .claude/skills/api-design/SKILL.md (or your agent's skills folder).
name
api-design
description
REST and GraphQL API design principles, versioning, error handling, and documentation patterns
metadata.author
cosmicstack-labs
metadata.version
1.0.0
metadata.category
backend
metadata.tags
api, rest, graphql, design, documentation, error-handling

API Design

Design APIs that are intuitive, consistent, and a joy to integrate with.

Core Principles

1. Consistency Over Cleverness

Your API should be predictable. If one resource uses POST /users, another shouldn't use POST /createUser. Patterns should be uniform across the entire surface.

2. Resources, Not Actions

URLs name resources. HTTP verbs name actions. /users is a resource. POST /users creates one. DELETE /users/123 removes one.

3. Developer Experience First

Your API's consumers are developers. Good DX means clear errors, thorough documentation, predictable responses, and sensible defaults.

4. Backward Compatibility

Once a field or endpoint is public, removing it breaks consumers. Version carefully. Add fields, don't remove them. Deprecate before deleting.


API Quality Scorecard

DimensionPoorGoodExcellent
URL structure/getUsers, /create_user/users, POST /users/users, /users/:id, with HATEOAS links
HTTP methodsAll POSTCRUD mapped properlyProper status codes, idempotency
Error formatHTML or plain textJSON with messageRFC 7807 Problem Details
PaginationNone or offsetCursor-basedCursor + metadata + total hints
VersioningNoneURL prefix /v1/Header or content negotiation
DocumentationNoneSwagger/OpenAPIInteractive docs with examples
Rate limitingNoneX-RateLimit-* headersGranular per-endpoint limits

Target: Good for internal APIs. Excellent for public APIs.


Actionable Guidance

RESTful URL Design

Pattern: /{version}/{resource}[/{resource-id}][/{sub-resource}]

# Good
GET    /v1/users                    # List users
POST   /v1/users                    # Create user
GET    /v1/users/{id}               # Get user by ID
PATCH  /v1/users/{id}               # Partial update user
DELETE /v1/users/{id}               # Delete user
GET    /v1/users/{id}/orders        # List user's orders
GET    /v1/users/{id}/orders/{oid}  # Get specific order

# Bad
GET    /v1/getUserInfo              # Verb in URL
POST   /v1/createNewUser            # Verb, camelCase
PUT    /v1/updateUser               # Verb, vague
GET    /v1/users_list               # Underscore, not a resource
POST   /v1/delete_user/123          # POST for deletion, imperative style

Naming conventions:

  • Plural nouns: /users, /orders, /products
  • Lowercase with hyphens: /order-items, not /orderItems or /order_items
  • No file extensions: /users/123, not /users/123.json
  • No verbs in URLs: Use HTTP verbs for actions
HTTP Methods and Status Codes
MethodActionSuccess CodeBody Contains
GETRetrieve200 OKResource(s)
POSTCreate201 CreatedCreated resource
PUTFull replace200 OKReplaced resource
PATCHPartial update200 OKUpdated resource
DELETERemove204 No Content(empty)

Common status codes:

CodeMeaningWhen
200OKSuccessful GET, PUT, PATCH
201CreatedSuccessful POST
204No ContentSuccessful DELETE
400Bad RequestMalformed input, validation failure
401UnauthorizedMissing/invalid auth token
403ForbiddenValid auth but insufficient permissions
404Not FoundResource doesn't exist
409ConflictDuplicate resource, version conflict
422UnprocessableSemantic validation failure
429Too Many RequestsRate limit exceeded
500Internal Server ErrorUnhandled server error
Show full SKILL.md (233 more words)Show less
Error Response Format

Use RFC 7807 (Problem Details):

json
HTTP/1.1 422 Unprocessable Content
Content-Type: application/problem+json

{
  "type": "https://api.example.com/errors/validation-error",
  "title": "Validation Error",
  "status": 422,
  "detail": "The request body contains invalid fields.",
  "instance": "/v1/users",
  "errors": [
    {
      "field": "email",
      "message": "Must be a valid email address",
      "code": "INVALID_FORMAT"
    },
    {
      "field": "age",
      "message": "Must be a positive integer",
      "code": "OUT_OF_RANGE"
    }
  ]
}
Pagination

Cursor-based pagination (recommended for most APIs):

json
GET /v1/users?cursor=eyJpZCI6MTB9&limit=20

{
  "data": [...],
  "pagination": {
    "next_cursor": "eyJpZCI6MzB9",
    "has_more": true
  }
}

Offset-based (acceptable for small, stable datasets):

json
GET /v1/users?page=2&per_page=20

{
  "data": [...],
  "pagination": {
    "page": 2,
    "per_page": 20,
    "total": 154,
    "total_pages": 8
  }
}
Versioning

Strategy: URL prefix versioning (most common, clearest)

/v1/users
/v2/users

When to bump version:

  • Removing a field or endpoint
  • Changing response structure (e.g., renaming fields)
  • Changing request/response semantics
  • Changing authentication requirements

When NOT to bump version:

  • Adding new fields (consumers should ignore unknown fields)
  • Adding new endpoints
  • Bug fixes that don't change API contract
GraphQL Considerations
  • N+1 problem: Use DataLoader for batching
  • Auth at resolver level: Never in field-level middleware
  • Max query depth: Prevent runaway queries with depth limiting
  • Persisted queries: Use for production to reduce overhead
  • Nullable by default: Make fields nullable unless you're certain
graphql
type Query {
  user(id: ID!): User
}

type User {
  id: ID!
  name: String!
  email: String  # Nullable — might be hidden for privacy
  orders: [Order!]!  # Non-null list, but could be empty
}
API Documentation

OpenAPI 3.0 example:

yaml
openapi: "3.0.0"
paths:
  /v1/users:
    get:
      summary: List users
      parameters:
        - name: cursor
          in: query
          schema: { type: string }
        - name: limit
          in: query
          schema: { type: integer, minimum: 1, maximum: 100, default: 20 }
      responses:
        "200":
          description: Paginated list of users
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items: { $ref: "#/components/schemas/User" }
                  pagination:
                    $ref: "#/components/schemas/Pagination"

Common Mistakes

  1. Inconsistent error responses: Different endpoints returning different error shapes. Standardize on one format.
  2. Exposing internal IDs: Use opaque public IDs (UUIDs) instead of auto-increment integers.
  3. No pagination on list endpoints: Returning all records is a performance and reliability risk.
  4. PUT for partial updates: Use PATCH. PUT should replace the entire resource.
  5. Nesting too deep: /v1/users/{id}/orders/{oid}/items/{iid} — keep nesting to 2-3 levels max.
  6. Returning 500 for validation errors: Validation failures are client errors — use 400/422.
  7. No rate limiting headers: Tell clients their limits with headers. Don't just drop connections.
  8. Synchronous long operations: If an operation takes >5 seconds, use 202 Accepted with a status URL.

© cosmicstack-labs, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in categories/backend/api-design of cosmicstack-labs/mercury-agent-skills.

Open the folder on GitHubat commit 30392fb

Compare with similar skills

API Design next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

API Design compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
API Design this skillcosmicstack-labs/mercury-agent-skills476—~1.9kAutomated safety check: PassMIT
API DesignerJeffallan/claude-skills12k2 repos~2kAutomated safety check: PassMIT
Nodejs Backend Patternsever-works/ever-works15818 repos~4kAutomated safety check: PassAGPL-3.0
API Design Principlesjh941213/my-cc-harness12620 repos~3.4kAutomated safety check: PassNone
API And Interface Designdzhalaevd/Donatello1359 repos~2.6kAutomated safety check: PassApache-2.0
Designing APIsCloudAI-X/claude-workflow-v21.4k2 repos~1.2kAutomated safety check: PassMIT

Similar skills

  • API Designer

    Jeffallan/claude-skills

    Designs REST and GraphQL APIs from resource modeling to an OpenAPI 3.1 contract, with versioning, pagination and RFC 7807 error handling.

    12k GitHub starsUsed in 2 repos~2k tokens
    Backend & APIsAuto-check passed
  • Nodejs Backend Patterns

    ever-works/ever-works

    Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices.

    158 GitHub starsUsed in 18 repos~4k tokens
    Backend & APIsAuto-check passed
  • API Design Principles

    jh941213/my-cc-harness

    REST 및 GraphQL API 설계 원칙 가이드. An agent skill from jh941213/my-cc-harness.

    126 GitHub starsUsed in 20 repos~3.4k tokens
    Backend & APIsAuto-check passed
  • API And Interface Design

    dzhalaevd/Donatello

    Guides stable API and interface design. An agent skill from dzhalaevd/Donatello.

    135 GitHub starsUsed in 9 repos~2.6k tokens
    Backend & APIsAuto-check passed
  • Designing APIs

    CloudAI-X/claude-workflow-v2

    Designs REST and GraphQL APIs including endpoints, error handling, versioning, and documentation.

    1.4k GitHub starsUsed in 2 repos~1.2k tokens
    Backend & APIsAuto-check passed
  • GraphQL Architect

    Jeffallan/claude-skills

    Designs GraphQL schemas and Apollo Federation graphs, with DataLoader resolvers, subscriptions, query complexity limits and caching.

    12k GitHub starsUsed in 1 repo~1.3k tokens
    Backend & APIsAuto-check passed

More from cosmicstack-labs/mercury-agent-skills

All 12 skills in this repo
  • Before You Build

    cosmicstack-labs/mercury-agent-skills

    Use this before implementing a product, feature, SaaS, AI app, or side project to score product risk and choose the smallest validation step.

    476 GitHub stars~2.2k tokensUpdated 1 mo ago
    Auto-check passed
  • Hyperframes CLI

    cosmicstack-labs/mercury-agent-skills

    HyperFrames CLI dev loop — project scaffolding, validation (lint/inspect), browser preview with live reload, MP4/WebM rendering, and environment troubleshooting (doctor, browser, info, upgrade).

    476 GitHub stars~1.4k tokensUpdated 1 mo ago
    Auto-check passed
  • Hyperframes Media

    cosmicstack-labs/mercury-agent-skills

    Asset preprocessing for HyperFrames compositions — local text-to-speech narration (Kokoro-82M, no API key), audio/video transcription (Whisper), and background removal for transparent overlays…

    476 GitHub stars~1.7k tokensUpdated 1 mo ago
    Auto-check passed
  • Agent Handoff Protocols

    cosmicstack-labs/mercury-agent-skills

    Design and implement agent-to-agent handoff protocols for multi-agent systems.

    476 GitHub stars~4.1k tokensUpdated 1 mo ago
    Auto-check passed
  • Agent Health Monitoring

    cosmicstack-labs/mercury-agent-skills

    Monitor AI agent health, detect anomalies, set up alerting, and maintain observability dashboards for production multi-agent systems.

    476 GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed
  • Agent Task Delegation

    cosmicstack-labs/mercury-agent-skills

    Design and operate task delegation systems for multi-agent fleets.

    476 GitHub stars~3.4k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about API Design

What does API Design do?

REST and GraphQL API design principles, versioning, error handling, and documentation patterns. API Design is an agent skill from cosmicstack-labs/mercury-agent-skills.

When should I use API Design?

API Design fits situations like: tasks that involve API design; tasks that involve GraphQL.

How do I install API Design in Claude Code?

Run `npx skills add cosmicstack-labs/mercury-agent-skills --skill api-design -a claude-code`. Or copy the skill folder (categories/backend/api-design in cosmicstack-labs/mercury-agent-skills) into .claude/skills/api-design in your project. Claude Code loads it when a task matches its description.

How do I install API Design in Codex?

Run `npx skills add cosmicstack-labs/mercury-agent-skills --skill api-design -a codex`. Or copy the skill folder (categories/backend/api-design in cosmicstack-labs/mercury-agent-skills) into .agents/skills/api-design in your project. Codex loads it when a task matches its description.

Can I use API Design in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cosmicstack-labs/mercury-agent-skills --skill api-design -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/api-design, .gemini/skills/api-design, .github/skills/api-design and .opencode/skills/api-design in your project.

What does API Design need to run?

SKILL.md names no scripts, command-line tools or credentials: API Design is instructions for the agent only.

Does API Design access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is API Design safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does API Design use?

API Design is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does API Design use?

About 1.9k tokens (SKILL.md is roughly 7.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to API Design?

Skills that share tags, products or a category with API Design: API Designer (Jeffallan/claude-skills, 12k stars), Nodejs Backend Patterns (ever-works/ever-works, 158 stars), API Design Principles (jh941213/my-cc-harness, 126 stars) and API And Interface Design (dzhalaevd/Donatello, 135 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains API Design?

cosmicstack-labs (a GitHub organization) maintains it in cosmicstack-labs/mercury-agent-skills, which has 476 GitHub stars. The repository holds 12 skills in this directory. The repository was last updated on August 25, 2026.

Source: cosmicstack-labs/mercury-agent-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.