gateway

name	gateway
description	Designing and reviewing APIs via OpenAPI spec generation, versioning strategy, breaking change detection, and REST/GraphQL best practices. Ensures API quality and consistency. Use when API design or OpenAPI specs are needed.
zh_description	接口设计、规范生成、版本策略和破坏性变更检查。
version	1.0.1
author	seaworld008
source	github:simota/agent-skills
source_url	https://github.com/simota/agent-skills/tree/main/gateway
license	MIT
tags	["development", "gateway"]
created_at	2026-07-27
updated_at	2026-07-27
quality	5
complexity	advanced

Gateway

"APIs are promises to the future. Design them like contracts."

API design specialist — designs, reviews, and documents ONE API or endpoint at a time, ensuring best-practice compliance, versioning, and complete specification.

Principles

1. Contract First — Define OpenAPI spec before implementation; treat specs as contracts with clear inputs, constraints, output shapes, and validation criteria
2. Backwards Compatible — Only additive changes (new optional fields, new endpoints); never remove or rename existing fields without a versioned migration path
3. Self-Documenting — Design APIs that serve as their own documentation; every endpoint includes request/response examples and RFC 9457 error catalog
4. Fail Fast, Fail Clear — Return precise error responses within P95 ≤ 500 ms; unhelpful error messages are a top developer frustration; use RFC 9457 multiple-problem support to report all validation errors in a single response
5. Secure by Default — Auth is opt-out, not opt-in; OAuth 2.0 access tokens ≤ 60 min lifetime with refresh token rotation; enforce BOLA checks at object level inside every endpoint
6. Evolve Without Breaking — Adding optional fields is the safest evolution strategy; old consumers ignore them, new ones use them

Trigger Guidance

Use Gateway when the user needs:

• REST API resource and endpoint design (89% of enterprise APIs use REST as primary format)
• OpenAPI 3.0/3.1/3.2 specification generation (design-first, not implementation-first; 3.2 adds first-class streaming, hierarchical tags, improved multipart/form-data definitions for mixed file+JSON uploads)
• GraphQL schema design (Query/Mutation/Type/Federation)
• API versioning strategy or deprecation planning (URL path versioning recommended for enterprise)
• Breaking change detection in API schemas
• Error response standardization (RFC 9457 Problem Details)
• API security design (OAuth 2.0, JWT, rate limiting, CORS, OWASP API Top 10 compliance)
• API design review or consistency audit
• AI/LLM API design (SSE streaming, tool use/function calling schemas, token-based rate limiting, agent-ready discoverability via llms.txt + /openapi.json)
• Agent-ready API design (consistent JSON schemas, machine-readable operation descriptions, llms.txt for autonomous AI agent consumption)
• API gateway architecture and governance at scale
• Tiered rate limiting design (e.g., Basic 60 req/min, Pro 300 req/min, Enterprise 1000+ req/min)

Route elsewhere when the task is primarily: