skills.rest
human-centric-engineering
human-centric-engineeringOFFICIAL
Explore all skills by this author →
WebsiteGitHub

api-builder

Generates Next.js API routes with Zod validation, auth guards, and rate limiting.

Updated Jul 28, 2026
Search Tags:#authentication#api#rate limiting#validation#next.js#zod#rest endpoint
One-click install
npx skills add https://github.com/human-centric-engineering/resparkable --skill api-builder-human-centric-engineering
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-builder
Source: https://github.com/human-centric-engineering/resparkable/tree/main/.claude/skills/api-builder
Command: npx skills add https://github.com/human-centric-engineering/resparkable --skill api-builder-human-centric-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Building API endpoints that match an existing codebase's conventions is error-prone: developers forget auth wrappers, skip rate limiting on mutating routes, or write inconsistent error responses. This Skill produces routes that follow the Resparkable codebase pattern exactly, so new endpoints pass review without rework. ## Core Features & Use Cases - Canonical route recipe: Generates handlers wrapped in withAuth / withAdminAuth from lib/auth/guards.ts, with typed errors instead of try/catch blocks. - Standard envelope and validation: Uses successResponse / paginatedResponse helpers and Zod schemas in lib/validations/ for all request bodies and query params. - Security built in: Applies the mandated rate-limit pattern on POST/PATCH/DELETE endpoints and structured route logging via getRouteLogger. - Use Case: You need a new admin endpoint to list and create widgets. The Skill produces app/api/v1/widgets/route.ts with pagination, search filtering, rate limiting, and a matching Zod schema, then hands tests off to the testing skill. ## Quick Start Ask the agent to create a new API endpoint for a resource under app/api/v1 following the api-builder recipe.

Frequently Asked Questions about api-builder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a new API route in Next.js App Router with authentication?▼

Wrap the exported handler with withAuth or withAdminAuth from lib/auth/guards.ts. The wrapper resolves the session, checks roles, and formats errors automatically, so the handler receives the session as an argument and never needs try/catch.

How to validate request bodies and query params with Zod in API routes?▼

Define schemas in lib/validations/ and pass them to validateRequestBody or validateQueryParams inside the handler. These helpers throw a ValidationError automatically when the schema rejects, which the auth wrapper converts into the standard error envelope.

Should API route handlers use try/catch for error handling?▼

No. Handlers wrapped in withAuth or withAdminAuth should throw typed errors like NotFoundError or ConflictError from lib/api/errors. The wrapper catches them and emits the standard error envelope with the correct status code.

Which rate limiter should I use for a mutating endpoint?▼

Pick the closest pre-built limiter from lib/security/rate-limit, such as adminLimiter for admin writes or apiLimiter for generic authenticated mutations. Key anonymous endpoints by client IP and authenticated ones by user ID.

How do dynamic route params work in Next.js 16 route handlers?▼

Params are async in Next.js 16. Add a generic to the wrapper, for example withAuth<{ id: string }>, then await params inside the handler to read the id before querying the database.

Does this Skill write tests for the endpoints it creates?▼

No. Test writing is deferred to the testing skill or the /test-write command so a separate review lens applies. The api-builder skill produces only the route handler and its Zod schema.

Related Skills

Explore More Software Engineering Skills→
ArtisanClarinetsArtisanClarinets

prisma-data-model

Enforce tenant isolation and audit-ready mutations in Prisma data models.

Community
Intermediate
human-centric-engineeringhuman-centric-engineering

testing

Guides writing and auditing Vitest tests with an anti-green-bar verification mindset.

Official
Advanced
FenntasyFenntasy

web-security

Review web application security posture across frontend, API, and server boundaries.

Community
Advanced
pmcdowallpmcdowall

native-mcp

Connect AI agents to external MCP servers and expose their tools.

Community
Advanced