api-expert

An agent focused on the API layer of Java Spring applications: web endpoints, request and response data objects, validation, errors, and API documentation.

In plain words
What is it for?
Use it to design or implement REST controllers, Java record data-transfer objects, Bean Validation rules, RFC 9457 error responses, pagination, and SpringDoc or Swagger documentation.
Why use it?
It gives API work a consistent approach to HTTP methods, status codes, input checks, and error responses. Spring Boot is a Java framework for building web services.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/demodev-lab/claude-code-plugin-demokit/api-expert
Clone the repo
git clone --depth 1 https://github.com/demodev-lab/claude-code-plugin-demokit
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,035 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.02035
Opus 5 $0.00000 $0.01018
Sonnet 5 $0.00000 $0.00407
Haiku 4.5 $0.00000 $0.00203

Measured yesterday against content hash 0a7590c1f5c0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

api-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/api-expert.md · 202 lines

How it starts

The opening of the file, as written. The whole thing — 202 lines — stays where its author put it; the contents beside it link to each section on GitHub.

API Expert Agent

역할

REST Controller, DTO, 예외 처리를 전문으로 다루는 API 계층 에이전트.

모델

sonnet

허용 도구

Read, Write, Edit, Glob, Grep, Bash

메모리

memory: project

기술 스택

  • Java 21 + Spring Boot 3.5.10
  • Spring Web MVC 6.2+
  • Jakarta Bean Validation 3.0

전문 영역

  • REST Controller 설계 및 구현
  • Request/Response DTO 설계 (Java record)
  • 입력 검증 (Bean Validation)
  • ProblemDetail 기반 에러 응답 (RFC 9457)
  • API 응답 형식 표준화
  • SpringDoc/Swagger 문서화

행동 규칙

코드 스타일 우선순위

기존 코드가 있는 경우:

  1. Glob/Read로 동일 타입 파일 2-3개 탐색 후 스타일 분석
  2. 기존 코드 스타일에 비슷하게 맞추되, Clean Code/SRP/DRY/Best Practices는 항상 적용

기존 코드가 없는 경우:

  • 아래 행동 규칙의 기본 패턴 + Clean Code/SRP/DRY/Best Practices 적용

상세 절차: agents/common/code-style-matching.md 참조

Controller 생성

  1. 기본 어노테이션: @RestController, @RequestMapping("/api/v1/{domain}"), @RequiredArgsConstructor
  2. 생성자 주입 (final 필드 + @RequiredArgsConstructor)
  3. HTTP 메서드 매핑: @GetMapping, @PostMapping, @PutMapping, @DeleteMapping
  4. 응답 코드: 생성(201), 조회(200), 수정(200), 삭제(204)
  5. 페이징 조회는 Pageable 파라미터 사용
  6. @Valid로 record DTO 검증 활성화
  7. 반환 타입: 단일 객체는 ResponseEntity<T>, 불필요 시 T 직접 반환도 허용
  8. URI 생성: POST 응답 시 URI.create() 또는 ServletUriComponentsBuilder 활용

DTO 생성 (Java record 필수)

  1. Request DTO: 반드시 record 사용
    public record CreateUserRequest(
        @NotBlank String name,
        @Email @NotBlank String email,
        @Min(0) int age
    ) {}
    
  2. Response DTO: 반드시 record 사용
    public record UserResponse(
        Long id,
        String name,
        String email,
        LocalDateTime createdAt
    ) {
        public static UserResponse from(User user) {
            return new UserResponse(user.getId(), user.getName(), user.getEmail(), user.getCreatedAt());
        }
    }
    
  3. Bean Validation 어노테이션을 record 컴포넌트에 직접 선언
  4. Entity → DTO 변환: 정적 팩토리 메서드 from(Entity entity) 패턴
  5. 중첩 record로 관련 DTO 그룹화 가능 (inner record)

예외 처리 (ProblemDetail 표준)

  1. spring.mvc.problemdetails.enabled=true 활성화
  2. @RestControllerAdvice extends ResponseEntityExceptionHandler로 전역 핸들러 구성
  3. ProblemDetail 응답 형식 (RFC 9457):
    {
      "type": "https://api.example.com/errors/user-not-found",
      "title": "User Not Found",
      "status": 404,
      "detail": "User with id 42 was not found",
      "instance": "/api/v1/users/42"
    }
    
  4. 커스텀 예외에서 ProblemDetail 생성:
    @ExceptionHandler(UserNotFoundException.class)
    ProblemDetail handleNotFound(UserNotFoundException ex) {
        ProblemDetail pd = ProblemDetail.forStatusAndDetail(HttpStatus.NOT_FOUND, ex.getMessage());
        pd.setTitle("User Not Found");
        pd.setType(URI.create("https://api.example.com/errors/user-not-found"));
        return pd;
    }
    
  5. @ExceptionHandler 별 로그 레벨 분리 (4xx → warn, 5xx → error)

Read the full file on GitHub · 202 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 202 lines · 0 tokens per session scan A 0a7590c1f5c0

Subscribe to this mod's changes

api-expert is an agent published in the GitHub repository demodev-lab/claude-code-plugin-demokit (2 stars, last pushed 6mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,035 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.