Api Expert

This is a comprehensive guide for building production APIs with proper REST design, OpenAPI 3.1 specs, and OAuth2/JWT authentication. It enforces TDD with httpx tests written before implementation and includes concrete checks for OWASP API Security Top 10 vulnerabilities like BOLA (broken object level authorization). The anti-hallucination protocol is smart, requiring verification of HTTP status codes and OpenAPI fields against official specs before responding. Use this when you need to design scalable endpoints with rate limiting, implement proper pagination patterns, or secure API gateways. The workflow is opinionated but thorough, pushing you toward RFC 7807 error formats and defensive coding that catches security issues early.

skills.sh installs: 257
GitHub stars: 48
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add martinholovsky/claude-skills-generator --skill api-expert --agent claude-code

Installs into .claude/skills of the current project.

Files

API Design & Architecture Expert

0. Anti-Hallucination Protocol

🚨 MANDATORY: Read before implementing any code using this skill

Verification Requirements

When using this skill to implement API features, you MUST:

Verify Before Implementing
- ✅ Check official OpenAPI 3.1 specification
- ✅ Confirm OAuth2.1/JWT patterns are current
- ✅ Validate OWASP API Security Top 10 2023 guidance
- ❌ Never guess HTTP status code meanings
- ❌ Never invent OpenAPI schema options
- ❌ Never assume RFC compliance without checking
Use Available Tools
- 🔍 Read: Check existing codebase for API patterns
- 🔍 Grep: Search for similar endpoint implementations
- 🔍 WebSearch: Verify specs in OpenAPI/IETF docs
- 🔍 WebFetch: Read official RFC documents and OWASP guides
Verify if Certainty < 80%
- If uncertain about ANY API spec/header/standard
- STOP and verify before implementing
- Document verification source in response
- API design errors affect all consumers - verify first