API Contracts

When to Use

Use when adding/modifying API routes, reviewing endpoint auth, checking request/response shapes, detecting breaking changes, or auditing the API surface. Not for video pipeline internals, UI design, n8n workflows, or ORM migration work (use migration-validator for that).

Critical Rules

1. Every new route must have Zod validation on request body (POST/PATCH/PUT).
2. Never change response shape of a production endpoint without a deprecation path.
3. Auth must be explicit — every route is either public, session-gated, or token-gated. No implicit auth.
4. Rate-limit public endpoints — contact forms, magic-link sends, checkout creation.
5. Worker routes use query params for userId — no session cookies on Express.
6. Document new routes in the API catalog below and update this skill.

Architecture