Manage API Catalog

Use this skill to create and maintain the /.well-known/api-catalog Linkset file per RFC 9727. The API Catalog provides a machine-readable index of all public API endpoints, their OpenAPI specifications, and documentation URLs — enabling agent orchestrators and developer tooling to auto-discover a service's API surface without prior knowledge.

Core Rules

• Format strictly according to RFC 9727 — the catalog is a Linkset document, not a generic JSON file.
• Map endpoints for OpenAPI specifications using service-meta relation type, and documentation using service-doc.
• The catalog MUST be placed at /.well-known/api-catalog (no .json extension per RFC 9727 spec).
• Serve with Content-Type: application/linkset+json or application/linkset as required by the request Accept header.
• Keep catalog entries stable — do not remove or rename existing anchor values once published; deprecate using the status field if the spec supports it.
• Treat the catalog as a public, signed contract: do not include internal-only API groups or unreleased endpoints without an explicit deprecation flag
• Validate every entry against the current RFC 9727 spec before deploy; reject schema-drifted Linksets (OWASP ASI04)
• Every service-meta and service-doc URL must be on the operator's own domain; reject third-party URLs at code review
• Set ETag and Last-Modified headers on the served catalog so external scanners and clients can detect silent changes (OWASP ASI01)

When to Use