| name | api-integration-contract-review |
| description | Reviews frontend-to-backend API contracts — BFF route handlers and direct backend calls — for data-minimization, server-side object-level authorization enforcement, error-shape leakage, CORS misconfiguration, and backward-compatible versioning before they ship. |
| allowed-tools | Read Grep Glob |
| metadata | {"author":"github: Raishin","version":"0.1.0","updated":"2026-07-02","category":"architecture"} |
API Integration Contract Review
Purpose
Review any new or changed API contract consumed by the frontend — a direct backend call or a BFF (backend-for-frontend) route handler — for data-minimization (no field returned to a client that the caller is not authorized to see), object-level authorization enforced independently on the server, error-shape safety (no upstream internals leaking to the client), CORS correctness, and backward-compatible versioning for existing consumers. This skill exists so those four concerns get a disciplined, security-severity review every time a contract is introduced or changed, instead of being waved through as "just wiring."
When to use
Use this skill when the user asks to:
- review a new API endpoint or BFF route handler before it ships,
- review a change to an existing response shape, status-code contract, or error format,
- audit whether the frontend fetches more fields than it renders,
- investigate a reported data-exposure or authorization-bypass (BOLA) concern,
- review CORS configuration for an endpoint that accepts credentialed requests.
