Synthex API route compliance scanner. NEVER apply generic REST conventions without grounding in Synthex's specific security pattern. ALWAYS audit against: getUserIdFromRequestOrCookies() auth, { organizationId } on every query, Zod safeParse() on all mutations, withRateLimit() on AI routes, and migrate diff + db execute for schema changes. Activate on ANY request to audit a route, check API security, review an endpoint, or scan for auth or org-scope issues.
Synthex API route compliance scanner. NEVER apply generic REST conventions without grounding in Synthex's specific security pattern. ALWAYS audit against: getUserIdFromRequestOrCookies() auth, { organizationId } on every query, Zod safeParse() on all mutations, withRateLimit() on AI routes, and migrate diff + db execute for schema changes. Activate on ANY request to audit a route, check API security, review an endpoint, or scan for auth or org-scope issues.
Scans any API route file and reports violations against the SYNTHEX standard
pattern. This skill catches the exact drift that causes technical debt: routes
using raw jwt.verify() as any instead of centralised auth, missing org
scoping, exposed error messages, duplicate utility functions, and more.
A senior engineer would never approve a route with as any casts on JWT
verification or a locally-defined getJWTSecret() when a centralised utility
exists. This skill encodes that judgement as automated checks.
When to Use
Activate this skill when:
Creating a new API route under app/api/
Modifying an existing API route
Reviewing a PR that touches API routes
Running a bulk compliance audit across all routes
Onboarding to understand the expected route pattern
When NOT to Use
For frontend component reviews (use code-review or design)
For database schema changes (use database-prisma)
For security surface beyond routes (use security-hardener)
For general architecture patterns (use architecture-enforcer)
Rule: Must use APISecurityChecker.check() OR getUserIdFromRequestOrCookies() from @/lib/auth/jwt-utils.
Anti-pattern: Raw jwt.verify() calls, custom getUserFromRequest() functions.
Check:
Fix: Remove local definition, import from @/lib/auth/jwt-utils.
HIGH (Warnings — should fix)
H1: Input Validation
Rule: All POST/PUT/DELETE request bodies must be validated with Zod.
Anti-pattern:const body = await request.json() without validation.
Check: Look for request.json() without a subsequent Zod .parse() or .safeParse().
Fix: Define a Zod schema and validate:
Rule: Never return raw error.message or stack traces to the client.
Anti-pattern:return NextResponse.json({ error: error.message }, { status: 500 })Check:
Rule: Routes querying user data must scope by userId or use getEffectiveQueryFilter().
Anti-pattern: Prisma queries without where: { userId } or where: { organizationId }.
Check: Look for prisma.<model>.findMany() without userId/orgId in the where clause.
Fix: Use getEffectiveQueryFilter(userId) from @/lib/multi-business/business-scope.
H4: Handler Parameter Types
Rule: Use NextRequest from next/server, not the generic Request type.
Anti-pattern:export async function GET(request: Request)Check:
grep -n "request: Request[^a-zA-Z]" <file>
Fix:import { NextRequest } from 'next/server' and use NextRequest.
MEDIUM (Suggestions — nice to have)
M1: Audit Logging
Rule: Write operations (POST/PUT/DELETE) should create audit log entries.
Check: Look for POST/PUT/DELETE handlers without auditLog or logger.info.
M2: Logger Usage
Rule: Use logger from @/lib/logger instead of console.log/console.error.
Check:
grep -n "console\.\(log\|error\|warn\)" <file>
M3: Runtime Export
Rule: Routes using Prisma should export const runtime = 'nodejs'.
Check: If file imports from @/lib/prisma, verify export const runtime = 'nodejs' exists.
M4: Credentials on Fetch
Rule: Client-side fetch calls include credentials: 'include'.
Check: Look for fetch( without credentials: 'include' in the options.
Input Specification
Parameter
Type
Required
Description
target
string
yes
File path or directory (e.g., app/api/campaigns/route.ts or app/api/)
scope
string
no
critical, high, medium, full (default: full)
fix
boolean
no
If true, apply auto-fixes where possible (default: false)
Confirm from the reference: HTTP path, allowed methods, auth level, Prisma models used.
Derive the filesystem path: convert /api/<path> → app/api/<path>/route.ts (App Router convention).
If the converted path does not resolve to an actual file, fall back to the filesystem grep:
NEVER flag generic REST issues without Synthex context, approve Prisma
queries without organizationId filter, accept prisma db push for schema
changes, or allow any auth system other than Supabase.
INSTEAD every route audit checks these Synthex-specific gates in order:
Auth: getUserIdFromRequestOrCookies(request) → 401 if null
Org scope: every DB query has { organizationId } or { campaign: { organizationId } }
Mutations: ZodSchema.safeParse(body) → 400 with { error, details } if invalid
Rate limiting: withRateLimit or equivalent wrapping AI and mutation routes
