backend-fastapi-python

A set of conventions for Python backend work using FastAPI, SQLModel, Pydantic settings, and asynchronous SQLAlchemy. A backend is the server-side code that handles data, business rules, and API requests.

In plain words
What is it for?
Use it to build or debug FastAPI endpoints, define schemas, write services, handle authentication and authorisation, create database migrations, and investigate validation errors such as HTTP 422 responses.
Why use it?
It reduces inconsistencies in service functions, authentication, responses, database relationships, validation, and error handling.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/avibebuilder/claude-prime/backend-fastapi-python
Any agent
npx skills add avibebuilder/claude-prime --skill backend-fastapi-python
Clone the repo
git clone --depth 1 https://github.com/avibebuilder/claude-prime

Made for: Claude Code, Codex.

Per session 135 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 876 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00135 $0.00876
Opus 5 $0.00068 $0.00438
Sonnet 5 $0.00027 $0.00175
Haiku 4.5 $0.00014 $0.00088

Measured 2d ago against content hash eb45fec00160, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

backend-fastapi-python scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/starter-skills/backend-fastapi-python/SKILL.md · 47 lines

How it starts

The opening of the file, as written. The whole thing — 47 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Backend FastAPI Python

Project-specific conventions for FastAPI with SQLModel, pydantic-settings, and async SQLAlchemy.

Architecture Decisions

  1. Services are stateless functions — Not classes. First param is db: AsyncSession.
  2. Generic response wrapper — Always use ApiResponse[T] for consistency.
  3. Dependencies chainget_current_user -> require_auth -> require_admin.
  4. Module-scoped config — Each module can have its own {module}_config.py.
  5. Error codes for frontendAppException(status, message, error_code).

Gotchas

  • SQLModel Relationship() fields are NOT included in API responses by default. You must explicitly add them to model_config or use a separate response schema with those fields.
  • AsyncSession.refresh() does not load relationships. After commit, re-query with .options(selectinload(...)) if you need related objects.
  • Pydantic V2 uses model_validator not validator. The @validator decorator is V1 and will break silently or raise deprecation warnings.
  • Depends() in FastAPI creates a NEW instance per request — don't store state in dependency return values expecting it to persist.
  • Background tasks (BackgroundTasks) run AFTER the response is sent. If they fail, the client already got a 200. Use proper task queues (Celery, ARQ) for anything that must not silently fail.
  • Alembic --autogenerate misses: table renames (generates drop+create), index changes on existing columns, and Enum type modifications in PostgreSQL. Always review generated migrations.
  • async def endpoints block the event loop if you call sync I/O inside them. Use run_in_executor for sync libraries or define the endpoint as def (FastAPI runs sync endpoints in a threadpool).
  • HTTPException from FastAPI and HTTPException from Starlette are different classes. Importing the wrong one causes middleware to miss exception handlers.
  • SQLAlchemy's lazy="selectin" on relationships causes N+1 queries in async sessions. Use explicit selectinload() in queries instead.
  • Optional[str] = None in query params makes the field optional. str = None also works but loses type information — prefer the explicit Optional form.
  • When using response_model, FastAPI filters OUT any fields not in the model. If your response is missing data, check that the response model includes all fields, not just the ORM model.

Read the full file on GitHub · 47 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 47 lines · 135 tokens per session scan A eb45fec00160

Subscribe to this mod's changes

backend-fastapi-python is a skill published in the GitHub repository avibebuilder/claude-prime (119 stars, last pushed 3mo ago), licensed MIT. It adds 135 tokens to every session and 876 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.