What problem does it solve? Adding or evolving service endpoints often leads to schema drift, inconsistent error responses, missing auth checks, and tests that break in isolated environments. This Skill enforces a schema-first workflow so every endpoint is anchored to a validated OpenAPI 3.1 or JSON Schema contract with structured RFC 9457 errors, default-deny authorization, and sandbox-ready tests. ## Core Features & Use Cases - Schema-first contract binding: Author and validate OpenAPI 3.1 or JSON Schema contracts before writing handler code, with runtime boundary validators (Zod, Pydantic, TypeBox) bound strictly to the spec. - RFC 9457 Problem Details errors: Return standardized error envelopes with type, title, status, detail, instance, and invalid_params, while ensuring 5xx responses never leak stack traces or internal paths. - Security and observability wiring: Enforce default-deny auth/authz, idempotency keys, and rate limiting on mutating routes, plus OpenTelemetry spans with trace_id propagation. - Use Case: When adding a new POST /v1/orders endpoint, use this Skill to freeze the API contract, wire Zod boundary validation, add idempotency and rate limiting, and verify the handler passes integration tests inside a Level 0 air-gapped container using MSW v2 stubs. ## Quick Start Use the add-api-endpoint skill to create a new versioned POST endpoint with an OpenAPI contract, boundary validation, RFC 9457 errors, and sandbox-ready tests.
