API Design

What it does

When your agent uses it

• Specifying the wire contract an endpoint exposes
• Choosing a versioning scheme
• Standardizing error response bodies across services

Example prompts

• “/api-design”

Requirements

• Python 3
• Compatibility (from SKILL.md): Claude Code 2.1.277+.
• Pre-approved tools (allowed-tools): Read, Glob, Grep, WebFetch, WebSearch

Workflow steps

9 steps, taken from the first numbered list in SKILL.md.

1. 1Verbs in URLs (POST /createUser instead of POST /users)
2. 2Inconsistent error formats across endpoints
3. 3Breaking contracts without version bump
4. 4Plain text error responses instead of Problem Details
5. 5Sunsetting versions without deprecation headers
6. 6Exposing internal details (stack traces, DB errors) in errors
7. 7Missing Content-Type: application/problem+json on error responses
8. 8Supporting too many concurrent API versions (max 2-3)
9. 9Caching without considering version isolation

What it can do on your machine

Read from SKILL.md and the folder at commit 0ef71d2. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Glob
  • Grep
  • WebFetch
  • WebSearch

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/, which the agent can run.

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • rfc-editor.org
  • fastapi.tiangolo.com
  • developer.mozilla.org
  • spec.openapis.org
  • grpc.io
  • protobuf.dev
  • payloadcms.com
  • zod.dev
  • tanstack.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Claude Code 2.1.277+.

  From compatibility in the SKILL.md frontmatter.

Context cost

API Design loads about 2.9k tokens when it runs, and up to ~11k if it reads all its reference files. Until then it costs about 99 tokens; SKILL.md has 1,030 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~99

When it runs · the whole SKILL.md, loaded when a task matches

~2.9k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~11k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from yonatangross/orchestkit at commit 0ef71d2, republished under its MIT licence (© yonatangross). 1,030 words, ~2,874 tokens.

name

api-design

description

API contract design for REST and GraphQL, covering resource shape, URL and header versioning with deprecation windows, RFC 9457 Problem Details error handling, and OpenAPI specs. Use when specifying the wire contract an endpoint exposes, choosing a versioning scheme, or standardizing error response bodies across services. Framework-agnostic protocol layer, not runtime implementation.

allowed-tools

Read, Glob, Grep, WebFetch, WebSearch

compatibility

Claude Code 2.1.277+.

license

MIT

user-invocable

false

disable-model-invocation

false

metadata.owner-agent

backend-system-architect

metadata.category

document-asset-creation

metadata.version

2.0.0

metadata.author

OrchestKit

metadata.complexity

medium

metadata.tags

api-design, rest, graphql, versioning, error-handling, rfc9457, openapi, problem-details

path_patterns

**/routes/**, **/api/**, **/endpoints/**, openapi.*, swagger.*

# REST endpoint with versioning and RFC 9457 errors
from fastapi import APIRouter, Depends, Request
from fastapi.responses import JSONResponse

router = APIRouter()

@router.get("/api/v1/users/{user_id}")
async def get_user(user_id: str, service: UserService = Depends()):
    user = await service.get_user(user_id)
    if not user:
        raise NotFoundProblem(
            resource="User",
            resource_id=user_id,
        )
    return UserResponseV1(id=user.id, name=user.full_name)

© yonatangross, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 33 other files (scripts, references, assets) in src/skills/api-design of yonatangross/orchestkit.

• SKILL.md
• assets/asyncapi-template.yaml
• assets/openapi-template.yaml
• examples/fastapi-problem-details.md
• examples/orchestkit-api-design.md
• metadata.json
• references/graphql-api.md
• references/ork-delta.md
• references/payload-vs-sanity.md
• references/rest-patterns.md
• references/telegram-bot-api.md
• references/webhook-security.md
• references/whatsapp-waha.md
• rules/_sections.md
• rules/_template.md
• rules/errors-agent-facing.md
• rules/framework-openapi.md
• … and 17 more

Open the folder on GitHubat commit 0ef71d2