backend-api-performance-audit

name	backend-api-performance-audit
description	Use when Codex needs to audit Django backend/API performance, slow endpoints, pagination/filter/search gaps, sync heavy work, caching, rate limits, response size, or N+1 query risks.

Backend API Performance Audit

Goal

Evaluate backend/API performance risks and identify endpoints, view logic, serializers, services, and request paths that may become slow or expensive.

When to use

Use this skill when the user asks for backend performance, API bottlenecks, slow endpoints, pagination, filtering/search, caching, rate limits, response sizes, synchronous heavy work, or N+1 query detection.

Required steps

1. Load repo guidance and inspect backend entry points:
   • backend/web3d/api/urls.py
   • backend/web3d/urls.py
   • app-level api_views.py, admin_api_views.py, views.py, serializers/helpers/services
   • backend/web3d/tests.py and relevant app tests
2. Build an API inventory:
   • route, method, handler, auth requirement, query params, response shape
   • whether list endpoints have pagination, filters, search, ordering limits
3. Inspect hot paths:
   • login/bootstrap/profile/settings
   • library/blog/course lists
   • quiz start/submit/finalize/result
   • classroom dashboard/assignments/gradebook
   • leaderboard/gamification/notifications
   • admin list/detail/import/bulk actions
4. Look for performance risks:
   • ORM loops and possible N+1 queries
   • missing select_related, prefetch_related, only, defer, aggregation strategy
   • unbounded queryset/list serialization
   • large JSON response payloads
   • synchronous CPU/IO work inside request handlers
   • file/media processing in request path
   • repeated external calls without timeout/retry strategy
   • missing caching for read-heavy stable data
   • missing rate limiting on expensive endpoints
5. If safe local verification exists, use Django tests or local API calls. Do not hit production for load tests.
6. Classify findings P0/P1/P2/P3.
7. Write the report in Vietnamese to docs/audits/backend-api-performance-audit.md.

Output format

Write a Vietnamese Markdown report with:

1. API inventory tom tat
2. Endpoint co rui ro cao
3. Pagination/filter/search gaps
4. N+1 va ORM query risks
5. Sync heavy work va response-size risks
6. Cache/rate-limit recommendations
7. Phat hien P0/P1/P2/P3
8. Validation plan

Every finding must cite route/API handler/file/model evidence and recommended verification.

Quality checklist

• Confirm whether each list endpoint is bounded.
• Separate confirmed N+1 patterns from suspected patterns needing instrumentation.
• Identify which user journey is affected.
• Prefer targeted ORM/caching fixes before architectural rewrites.
• State whether dynamic query counting was performed.

Safety rules

• Do not mutate application data.
• Do not run production load tests.
• Do not apply migrations, deploy, upload, delete, or reset data.
• Do not print secrets, access tokens, cookies, or private user rows.
• Keep generated reports in docs/audits.