api-design-validation

# API Design & Validation Inspect current routes, schemas, authentication, and error conventions. Validate all untrusted inputs at the boundary; define request/response contracts, status codes, pagination, idempotency where appropriate, rate limits, and useful but non-sensitive errors. Enforce authorization on the server for each protected resource. Keep secrets and internal details out of responses. Add tests for malformed input, unauthorized access, edge cases, and success paths. Avoid breaking API changes without explicit approval.