API Endpoint Checklist

Request Contract

Required fields, optional fields, and default values are documented.Input validation rejects invalid types, unknown enum values, and unsafe lengths.Authentication and authorization rules are checked before business logic runs.Idempotency is considered for create, retry, payment, or webhook endpoints.

Response Design

Success responses use consistent status codes and stable JSON shapes.Error responses include a clear message, machine-readable code, and trace reference when useful.Pagination, filtering, and sorting behavior are predictable for list endpoints.Sensitive fields are excluded from every response path.

Production Readiness

Rate limits, abuse protection, or quota behavior are defined for public endpoints.Logs include enough context to debug without exposing secrets or private data.Metrics exist for latency, error rate, request volume, and dependency failures.Tests cover happy path, validation failures, permission failures, and edge cases.