Guidance for creating API documentation and OpenAPI specifications. An API is a defined way for software systems to communicate, while OpenAPI is a standard format for describing those endpoints.

Use it to write an API specification first, generate documentation from existing code, or publish interactive references with tools such as Swagger and Redoc.

It helps keep an API’s available operations, inputs, outputs, and examples clear and up to date for developers who use it.

apidocs — Skill for Claude Code by arbazkhan971

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add arbazkhan971/godmode --skill apidocs

Clone the repo

git clone --depth 1 https://github.com/arbazkhan971/godmode

Made for: Claude Code.

Or install godmode, the plugin that ships this one along with the rest of its 132 skills, 1 command, 7 agents, 3 MCP servers.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/arbazkhan971/godmode/apidocs/github.svg)](https://agentmods.dev/skills/arbazkhan971/godmode/apidocs)

Your own site

<a href="https://agentmods.dev/skills/arbazkhan971/godmode/apidocs"><img src="https://agentmods.dev/badge/skills/arbazkhan971/godmode/apidocs/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/arbazkhan971/godmode/apidocs"><img src="https://agentmods.dev/badge/skills/arbazkhan971/godmode/apidocs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 27 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,540 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 6 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Prompt Injection · line 112
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
medium MCP Rug Pull · line 59
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 102
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Fix: Pin the image: image:tag or image@sha256:abc123
medium MCP Rug Pull · line 119
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 151
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 165
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00027	$0.02540
Opus 5	$0.00014	$0.01270
Sonnet 5	$0.00005	$0.00508
Haiku 4.5	$0.00003	$0.00254

Measured 9d ago against content hash e0359a0cb5b0, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

apidocs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/apidocs/SKILL.md · 305 lines

How it starts

The opening of the file, as written. The whole thing — 305 lines — stays where its author put it; the contents beside it link to each section on GitHub.

APIDocs — Documentation Generation & Interactive Specs

Activate When

User invokes /godmode:apidocs
User says "generate API docs", "write OpenAPI spec", "set up Swagger"
User says "add Redoc", "create API reference", "document my API"
User says "auto-generate docs from code", "set up interactive docs"
When /godmode:api finishes and documentation needs to be published
When /godmode:review flags missing or outdated API documentation
When a codebase has API routes but no corresponding spec or docs

Workflow

Step 1: Discovery & Approach Selection

Determine the documentation strategy before generating anything:

APIDOCS DISCOVERY:
Project: <name and purpose>
Language/Framework: <Node/Express, Python/FastAPI, Java/Spring, Go, NestJS, etc.>

If the user hasn't specified, ask: "Do you want to write the spec first and generate code from it (spec-first), or generate the spec from existing code (code-first)?"

Step 2: Spec-First — Writing OpenAPI from Scratch

For spec-first (contract-first) development, produce a complete OpenAPI document:

# Template: OpenAPI 3.1 Spec-First
openapi: "3.1.0"
info:

Rules for spec-first:

Write the spec BEFORE any implementation. The spec is the contract.
Every field must have a description and an example.
Use $ref aggressively — never duplicate schema definitions.
Group related endpoints under tags.
Provide examples for every request body and response.
Include servers for all environments.
Add x- extensions for renderer-specific features (Redoc logo, Stoplight groups).

Step 3: Code-First — Auto-Generate Spec from Code

For code-first, configure the framework's doc generation:

CODE-FIRST SETUP BY FRAMEWORK:

Framework-specific setup:

Express: swagger-jsdoc + swagger-ui-express with JSDoc @openapi annotations
NestJS: @nestjs/swagger with DocumentBuilder and ApiProperty decorators
FastAPI: Built-in OpenAPI generation from Pydantic models
Spring Boot: springdoc-openapi with @Tag, @Operation annotations
tsoa: TypeScript decorators, npx tsoa spec generates spec
Go: swaggo/swag with comment annotations, swag init generates spec

Read the full file on GitHub · 305 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 305 lines · 27 tokens per session scan A e0359a0cb5b0

Subscribe to this mod's changes

apidocs is a skill published in the GitHub repository arbazkhan971/godmode (26 stars, last pushed 12d ago), licensed MIT. It adds 27 tokens to every session and 2,540 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs Writing and docs ai-agent ai-agents ai-code-review ai-skills automated-testing autonomous-coding

endpoint-validator

Deterministic API endpoint validation with pass/fail reporting.

notque/vexjoy-agent · 15 tokens

api-patterns

API design: naming, versioning, pagination, idempotency, OpenAPI, error contracts and safe retries. Triggers: API design, REST, GraphQL, OpenAPI, Swagger, error response, HTTP status, rate limit.

softspark/ai-toolkit · 52 tokens

java-patterns

Java: Spring Boot, CompletableFuture, records, sealed types, JPA/Hibernate, virtual threads. Triggers: Java, Spring, JPA, Hibernate, Maven, Gradle, virtual thread, sealed class.

softspark/ai-toolkit · 48 tokens

kafka-event-driven-design

Kafka event-driven architecture designer and reviewer, at the application/client layer. ALWAYS use when designing, reviewing, or troubleshooting how a service produces or consumes Kafka events — topic and partition-key design, producer and consumer client configuration, consumer group topology, event schema definition…

johnqtcg/awesome-skills · 191 tokens

api-baas-neon

Serverless PostgreSQL with branching, autoscaling, and edge-compatible driver.

agents-inc/skills · 20 tokens

api-caching-strategies

Application-level caching strategies, HTTP caching, cache invalidation, and stampede prevention.

agents-inc/skills · 23 tokens