Programmatic interfaces.
WHAT TO DEFINE
Routes in the API route file, which applies appropriate middleware.
WHAT TO RETURN
Consistent structure, appropriate status codes, and clear errors.
WHAT RESOURCES PROVIDE
A defined shape for what each model returns.
WHY THAT MATTERS
Returning a model directly exposes every column, including ones that should be private.
WHAT TO CONTROL
Exactly which fields are exposed.
WHAT TO IMPLEMENT
Authentication, using the framework's token or session-based approaches Rate limiting Validation on every input Pagination on collections
WHAT TO DOCUMENT
Every endpoint: what it does, what it expects, what it returns, what errors are possible.
WHAT TO VERSION
The API, before others depend on it.
WHY
Changing it afterwards breaks them.
WHAT TO RETURN ON VALIDATION FAILURE
A structured response naming each field and its problem.
WHAT NOT TO EXPOSE
Internal errors and stack traces.
WHAT TO TEST
Every endpoint, including unauthorised access attempts.
