What problem does it solve? Developers building APIs on the Frappe framework often miss critical permission checks in whitelisted methods, misuse authentication patterns, or expose endpoints without proper validation, leading to security vulnerabilities and broken integrations. ## Core Features & Use Cases - REST and RPC Patterns: Guidance on using built-in REST endpoints for DocType CRUD versus custom @frappe.whitelist RPC methods for business logic. - Authentication & Permissions: Covers token-based auth, OAuth 2.0 flows, session auth, and explicit permission checks with frappe.has_permission. - Production Hardening: Includes rate limiting, input validation, background job offloading, and structured error handling. - Use Case: You need to expose a custom order approval endpoint to an external system. This Skill walks you through creating a whitelisted method, verifying document permissions, validating inputs, and securing it with API key authentication. ## Quick Start Use the api-development skill to create a whitelisted Frappe endpoint that processes an order with proper permission checks and token authentication.
