AI Prompts for Claude for API Development

Design a RESTful API for [APPLICATION]. List the main resources, endpoints (method + path), and what each endpoint does. Apply REST naming conventions, HTTP method semantics, and appropriate status codes.

I am building an API for [USE CASE]. Compare REST, GraphQL, and gRPC for this specific case and recommend the best approach with a clear rationale.

Review this API design for problems: [PASTE ENDPOINTS OR SCHEMA]. Flag: naming inconsistencies, wrong HTTP methods, missing endpoints, REST violations, and versioning issues.

Design the authentication and authorization model for this API: [DESCRIBE API AND USERS]. Compare JWT, OAuth 2.0, API keys, and sessions for this use case and recommend the right approach.

Write an API contract for [RESOURCE]. Include: all endpoints, request schemas, response schemas, validation rules, and error response formats.

Write a [EXPRESS / FASTAPI / SPRING / GIN / ETC] handler for a [GET/POST/PUT/DELETE] endpoint at [PATH] that [DESCRIBE BEHAVIOR]. Include input validation, error handling, and correct status codes.

Write middleware for [AUTHENTICATION / RATE LIMITING / REQUEST LOGGING / CORS] for [FRAMEWORK]. Include the logic and an explanation of each decision.

Implement cursor-based pagination for this list endpoint: [PASTE HANDLER]. Update the response schema to include cursor and hasMore fields.

Write the data access layer for this endpoint: [DESCRIBE QUERY]. Use [ORM/LIBRARY] with parameterized queries that handle: empty results, large datasets, and invalid input gracefully.

Add comprehensive request validation to this endpoint: [PASTE ENDPOINT]. Validate all inputs, return 400 errors with specific field-level messages, and reject requests that do not conform to the schema.

Write a centralized error handling system for this API: [DESCRIBE STACK]. It should: catch all errors, return a consistent error schema, log with appropriate detail, and never expose stack traces to clients.

Security review this API endpoint: [PASTE CODE]. Check for: injection vulnerabilities, authentication bypass, insecure direct object references, missing rate limiting, and information disclosure.

Implement rate limiting for this API: [DESCRIBE API + TECH STACK]. Include per-user and per-IP limits, a 429 response with retry-after headers, and bypass for trusted internal callers.

Add input sanitization and validation to this endpoint: [PASTE CODE]. Identify every input that needs sanitization, implement the validation, and reject malformed requests early.

Write security-focused tests for this endpoint: [PASTE ENDPOINT]. Cover: unauthorized access, admin-only actions, invalid tokens, injection attempts, and server error handling.

Write integration tests for this endpoint using [TEST FRAMEWORK]: [PASTE HANDLER]. Test: success cases, validation errors, auth failures, not found, and server errors.

Write complete API reference documentation for these endpoints: [PASTE ROUTES AND HANDLERS]. Format for developers: description, request format, response format, example request/response, and all error codes.

Generate an OpenAPI 3.0 specification for this API: [PASTE ROUTES AND SCHEMAS]. Include all paths, request bodies, response schemas, security schemes, and error responses.

Write curl and [LANGUAGE] SDK examples for testing each endpoint: [PASTE ENDPOINT LIST]. Include examples for success cases, error cases, and authenticated requests.

Design an API versioning strategy for this API: [DESCRIBE CURRENT API]. Recommend URL versioning, header versioning, or another approach, explain the tradeoffs, and show the implementation.