service-api-patternslisted

# Recurring service and API patterns **Read [`references/SERVICE-API-PATTERNS.md`](references/SERVICE-API-PATTERNS.md) before applying any of this.** That file is the standard; everything below it is a summary to help you decide whether this skill applies and to check your work afterwards. Reference-architecture principles: P2, P9. ## What this standard covers - Rate limiting - Endpoint organization - Validation - Pagination and list queries - Cross-service HTTP calls - Long-running work without a queue - Background services vs migrations - Seeded definitions - Product mechanics worth reusing ## Checklist - [ ] Rate limiting from the kernel: user-partitioned with IP fallback, `auth`/`api`/global policies, uniform 429 body - [ ] Anonymous surfaces: one shared client resolver; the forwarded client header trusted only when configuration says a proxy is in front; rejections not queued; a process-wide concurrency bound underneath, with health probes exempt - [ ] Endpoint groups make the three trust levels visible in the composition root; operation names from constants - [ ] Validation filter (minimal APIs) / logging 400 factory (MVC); client mirrors marked, server authoritative - [ ] Every list endpoint clamps page/limit; page aggregates in one round trip - [ ] Service-to-service clients: no auto-redirect, 3xx → 502 + log, bearer forwarded, timeouts by criticality, handler timeouts explicit - [ ] Writes: a refused connection and a timeout reported differently; no retry of an