.NET Web / HTTP Service Conventions

This skill covers architecture-neutral cross-cutting concerns for HTTP services. It does not mandate an architecture.

Architecture

• Match the existing project's architecture and structure. In an established codebase, its conventions win - do not introduce a different pattern alongside the current one.
• For greenfield projects, the architecture is a deliberate decision made via a dedicated architecture skill, not assumed here. Load exactly one: vertical-slice-architecture for feature-folder/VSA work, or a layered reference (clean-architecture, ddd). Never load both in one project.
• This skill's rules below (HTTP, validation, resilience, API design, observability, caching) apply regardless of which architecture is chosen.

HTTP and packages

• Use IHttpClientFactory, not raw HttpClient.
• Use Directory.Packages.props (central package management) when the project supports it. Pin exact versions for security-sensitive packages.

Validation and resilience

• Validation: FluentValidation as default. ASP.NET Core ModelState only for trivial DTOs.
• Resilience: Microsoft.Extensions.Http.Resilience (AddStandardResilienceHandler(), Polly v8 core) for HttpClient pipelines; hand-built Polly v8 ResiliencePipeline for non-HTTP calls (DB, message broker).