fastapi-patterns

Place endpoints in routers/ (one file per domain), business logic in services/, and database queries in repositories/. Inject services into route handlers with Depends, always declare a response_model, and keep services free of HTTP objects like Request or JSONResponse.

Replace @validator with @field_validator and class Config with model_config = ConfigDict(...). Use ConfigDict(extra="forbid") to reject unknown fields and Field constraints like min_length and ge/le for validation.

Define custom exception classes with a public_message and register exception handlers that return only a generic code and message to clients. Log the full exception server-side with logger.exception, and never include str(exc) in the JSON response.

Yes, implement both as FastAPI dependencies. Use a Header-based dependency to verify an X-Internal-Secret for service-to-service calls, and a separate dependency that decodes Bearer JWT tokens for mobile-facing user endpoints.

Blocking calls inside an async function stall the event loop and degrade all concurrent requests. Wrap blocking work with await asyncio.to_thread(blocking_call) or define the endpoint as a regular sync def so FastAPI runs it in a threadpool.

Avoid wildcard CORS origins in production, hardcoded secrets instead of pydantic-settings env config, f-string SQL instead of parameterized queries, and logging raw PHI or user data. Each of these is flagged as an anti-pattern in this Skill.