production-api-integration
Skill3 starsChanged 3 months agoMITView on GitHub
Review API and integration readiness for production, including request validation, response consistency, status codes, auth, authorization, pagination, rate limiting, idempotency, webhooks, third-party failures, timeout handling, retry behavior, sensitive data exposure, and API documentation.
1 other project uses a version of this, 1 of them edited.
Adopted by
Most recently taken up by
- ArcanEdge-AI/coding-agent-playbook-claude-codeedited, first seen Nov 8, 2026
Other versions1 project uses a version of this.
Word for word · 0
None found.
Edited · 1
Wrote their own version · 0
None found.
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository33 other files it gives its agents.
- AGENTS.mdAGENTS.md
- aws-local-preflightSkill
- design-taste-frontendSkill
- feature-branch-lifecycleSkill
- handoffSkill
- humanizerSkill
- impeccableSkill
- legacy-path-retirementSkill
- local-ci-preflightSkill
- multi-role-repo-reviewSkill
- multi-session-coordinationSkill
- platform-documentationSkill
- production-architecture-reviewSkill
- production-code-qualitySkill
- production-database-integritySkill
- production-devops-releaseSkill
- production-documentation-onboardingSkill
- production-pass-orchestratorSkill
- production-performance-reviewSkill
- production-readiness-reportSkill
- production-reliability-observabilitySkill
- production-security-reviewSkill
- production-testing-qaSkill
- production-ux-accessibilitySkill
- reference-doc-routingSkill
- senior-code-reviewSkill
- session-cleanupSkill
- subagent-orchestrationSkill
- task-graph-orchestrationSkill
- taste-new-websiteSkill
- taste-redesign-websiteSkill
- technical-debt-auditorSkill
- worktree-lifecycleSkill
The file
We split this skill into the rules it gives an agent
9 rules. About 0 are common, 9 are distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈9
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 60
Add relevant tests when making authorized API behavior changes.
- Distinctive: line 61
Document breaking-change risks separately.
- Distinctive: line 62
Update API docs for authorized API changes.
- Distinctive: line 76
Do not break API contracts without explicit approval.
- Distinctive: line 77
Do not remove auth or validation to make tests pass.
- Distinctive: line 78
Do not leak internal errors to clients.
- Distinctive: line 79
Do not retry non-idempotent operations without safeguards.
- Distinctive: line 80
Do not log secrets or sensitive payloads.
- Distinctive: line 81
Do not hide integration failures as successful responses.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Production API Integration
Core purpose
Improve API predictability, integration safety, and failure handling without unnecessary breaking changes.
Use this skill when
- The production pass needs API or integration review.
- The repository exposes APIs, consumes APIs, uses webhooks, or depends on third-party services.
- The user wants APIs production-ready and predictable.
Do not use this skill when
- The application has no API or integration layer.
- The task is only frontend styling.
- The requested change would break public API behavior without approval.
Check for
- Request validation
- Response shape consistency
- Correct HTTP status codes
- Error response consistency
- Pagination
- Rate limiting
- Authentication
- Authorization
- Idempotency for sensitive operations
- Timeout handling
- Third-party failure handling
- Webhook signature validation
- API documentation gaps
- Breaking change risks
- Retry behavior
- Sensitive data exposure
- Internal error leakage
- Contract drift between client and server
Default workflow
Resolve the task mode first: assessment-only work reports findings without source, test, or repository-document edits; authorized remediation applies only in-scope fixes. Release, production, and destructive operations retain their separate authority requirements.
- Inspect route definitions, controllers, service clients, middleware, schemas, and API docs.
- Identify critical API flows.
- Identify external integrations and webhooks.
- Classify findings as Blocker, High, Medium, or Low.
- In an authorized remediation task, fix safe in-scope issues; for assessment-only requests, report them without editing:
- missing validation
- inconsistent errors
- missing status handling
- timeout gaps
- obvious auth checks
- webhook validation gaps
- Add relevant tests when making authorized API behavior changes; in assessment mode, report coverage gaps.
- Document breaking-change risks separately.
- Update API docs for authorized API changes; in assessment mode, report documentation gaps.
Severity guidance
Classify as Blocker when API behavior creates critical security, data loss, payment, auth, or production availability risk.
Classify as High when API flaws create serious release risk or likely production incidents.
Classify as Medium when improvements should be scheduled soon.
Classify as Low for optional consistency or documentation polish.
Guardrails
- Do not break API contracts without explicit approval.
- Do not remove auth or validation to make tests pass.
- Do not leak internal errors to clients.
- Do not retry non-idempotent operations without safeguards.
- Do not log secrets or sensitive payloads.
- Do not hide integration failures as successful responses.
Deliverables
Include the following in the requested assessment response or report. Update repository readiness files only when those artifacts are requested or part of authorized remediation:
- API readiness summary
- Integration risk summary
- Safe fixes applied
- Tests added or updated
- Remaining API risks
- Files changed and reasons
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.