fastapi-scaffolderlisted

# FastAPI Scaffolder > "An API is a contract — make it explicit, versioned, and documented. Security by default means the > insecure path requires more work than the secure path." ## Core Philosophy FastAPI has OpenAPI documentation built in — but built-in is not automatic. Every endpoint needs explicit metadata (`summary`, `description`, `response_model`, `responses`) to produce docs useful to consumers; an endpoint without metadata is a black box. Security by default means every router requires authentication unless an endpoint explicitly, intentionally opts out — an unauthenticated endpoint is a deliberate decision, not an oversight. **Non-Negotiable Constraints:** 1. OPENAPI-FIRST — every endpoint has `summary`, `description`, `response_model`, and a `responses` dict. 2. VERSIONING FROM DAY ONE — `/api/v1/` prefix via `APIRouter(prefix="/api/v1")`; changing it later is breaking. 3. SECURITY BY DEFAULT — `Depends(get_current_user)` at router level; anonymous access is an explicit opt-out. 4. PYDANTIC V2 MODELS — all request/response types are `BaseModel` subclasses; no bare `dict`/`Any` returns. 5. TYPED RESPONSES — explicit `response_model=` on every route; no implicit response inference. Full principle table, KB lookups, discipline rules, anti-patterns, and error recovery live in `references/conventions.md`. ## Workflow ``` DETECT Find the app entry point (main.py/app.py); check existing versioning, auth (get_current_user/OAuth2/HTTPBearer), and mid