AgentSkillsCN

api-patterns

API 设计原则与决策方法。在 REST、GraphQL 和 tRPC 之间进行选型，同时关注响应格式、版本控制与分页策略。

SKILL.md
--- frontmatter
name: api-patterns
description: API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.
allowed-tools: Read, Write, Edit, Glob, Grep

API Patterns

API design principles and decision-making for 2025. Learn to THINK, not copy fixed patterns.

🎯 Selective Reading Rule

Read ONLY files relevant to the request! Check the content map, find what you need.

📑 Content Map

FileDescriptionWhen to Read
api-style.mdREST vs GraphQL vs tRPC decision treeChoosing API type
rest.mdResource naming, HTTP methods, status codesDesigning REST API
response.mdEnvelope pattern, error format, paginationResponse structure
graphql.mdSchema design, when to use, securityConsidering GraphQL
trpc.mdTypeScript monorepo, type safetyTS fullstack projects
versioning.mdURI/Header/Query versioningAPI evolution planning
auth.mdJWT, OAuth, Passkey, API KeysAuth pattern selection
rate-limiting.mdToken bucket, sliding windowAPI protection
documentation.mdOpenAPI/Swagger best practicesDocumentation
security-testing.mdOWASP API Top 10, auth/authz testingSecurity audits

🧠 Decision Matrix (Expert)

StyleBest ForProsCons
RESTPublic APIs, Simple CRUDCaching, Universal supportOver-fetching, multiple round-trips
GraphQLComplex Frontends, Mobile AppsSingle request, Flexible dataComplexity, N+1 queries, Harder caching
tRPCTypeScript Monorepos (Next.js)End-to-end type safety, SpeedTight coupling (Frontend+Backend)
gRPCMicroservices (Internal)High performance (Protobuf), StreamingBrowser support is weak (requires proxy)

🛡️ Robustness Patterns

Idempotency

Problem: User clicks "Pay" twice. You charge them twice. Solution: Client sends Idempotency-Key: <uuid>.

  1. •Server checks Redis: GET idempotency:<uuid>.
  2. •If exists: Return cached 200 OK immediately.
  3. •If new: Process charge, save result to Redis, return 200 OK.

Rate Limiting (Algorithms)

AlgorithmHow it worksProsCons
Fixed Window"100 reqs per hour" (resets at :00)SimpleStampede at window reset
Sliding WindowSmoothed over timeFairerMore Redis memory needed
Token Bucket"Bucket of coins", refill at rate XAllows bursts (good for users)Complex implementation

🔗 Related Skills

NeedSkill
API implementation@[skills/backend-development]
Data structure@[skills/database-design]
Security details@[skills/security-hardening]

✅ Decision Checklist

Before designing an API:

  • • Asked user about API consumers?
  • • Chosen API style for THIS context? (REST/GraphQL/tRPC)
  • • Defined consistent response format?
  • • Planned versioning strategy?
  • • Considered authentication needs?
  • • Planned rate limiting?
  • • Documentation approach defined?

❌ Anti-Patterns

DON'T:

  • •Default to REST for everything
  • •Use verbs in REST endpoints (/getUsers)
  • •Return inconsistent response formats
  • •Expose internal errors to clients
  • •Skip rate limiting

DO:

  • •Choose API style based on context
  • •Ask about client requirements
  • •Document thoroughly
  • •Use appropriate status codes

Script

ScriptPurposeCommand
scripts/api_validator.pyAPI endpoint validationpython scripts/api_validator.py <project_path>