api-design-reviewlisted

# API Design Review A structured, evidence-based review of an API's **contract design and cross-endpoint consistency** — REST, GraphQL, gRPC, or a mix of these — for backend developers and architects designing or reviewing a public or internal API surface. It investigates actual route/resolver/proto definitions and any spec files, and reports one table the user can act on. **Scope boundary — read this before starting.** This skill checks whether an API's *contract* is well-designed and internally consistent: naming, HTTP semantics, status codes, error shapes, pagination, idempotency, versioning, compatibility, and spec accuracy. It explicitly does **not** cover: - **Authentication/authorization/injection/access control** — that's `cybersecurity-check` (its S1, S11, S12, S19 items in particular). If an endpoint's auth looks off during this review, note it in one line and point to that skill rather than assessing it here. - **Latency, throughput, N+1 query performance impact, caching strategy** — that's `performance-audit`. This skill flags the *design pattern* that predicts an N+1 problem (e.g. a GraphQL resolver with no batching) as a design smell, but does not measure or size its actual performance impact — that's the other skill's job. ## Ground rules - **Evidence or it didn't happen.** Every row needs a concrete pointer: an actual route/handler file and line, an actual resolver or `.proto` definition, an actual example request/response captured from code