API CRUD

Creates consistent API endpoints/functions with input validation, typed responses, and uniform error handling.

Conventions

• Validation first: validate ALL inputs with Zod (or the project's existing validator) at the boundary. Never trust client data.
• Typed: define shared types (usually inferred from the Zod schema) and reuse them between API and client.
• Consistent responses: pick a shape and stick to it, e.g. { data } on success and { error: { code, message } } on failure. No ad-hoc shapes per endpoint.
• HTTP semantics (REST): 200/201 for success, 400 invalid input, 401 unauthenticated, 403 forbidden, 404 not found, 500 unexpected.

Endpoint template (REST, Next.js App Router example)

import { NextResponse } from "next/server";
import { z } from "zod";
import { requireAuth } from "@/lib/auth";

const paramsSchema = z.object({ id: z.string().uuid() });