Borrowing it
Nothing to install: this file belongs to cohen-liel/hivemind. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/cohen-liel/hivemind/main/.claude/skills/api-design/SKILL.mdgit clone --depth 1 https://github.com/cohen-liel/hivemindWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cohen-liel/hivemind/api-design)<a href="https://agentmods.dev/skills/cohen-liel/hivemind/api-design"><img src="https://agentmods.dev/badge/skills/cohen-liel/hivemind/api-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cohen-liel/hivemind/api-design"><img src="https://agentmods.dev/badge/skills/cohen-liel/hivemind/api-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.00919 |
| Opus 5.5 | $0.00013 | $0.00368 |
| Sonnet 5.5 | $0.00007 | $0.00184 |
| Haiku 4.5 | $0.00003 | $0.00092 |
Grade A, and why
api-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.
REST API Design Patterns
URL Structure
# Resources (nouns, plural, lowercase-kebab)
GET /api/v1/users # List users
POST /api/v1/users # Create user
GET /api/v1/users/{id} # Get user
PUT /api/v1/users/{id} # Replace user
PATCH /api/v1/users/{id} # Update user partially
DELETE /api/v1/users/{id} # Delete user
# Nested resources
GET /api/v1/users/{id}/posts # User's posts
POST /api/v1/users/{id}/posts # Create post for user
# Actions (when CRUD doesn't fit)
POST /api/v1/users/{id}/activate
POST /api/v1/auth/login
POST /api/v1/auth/logout
POST /api/v1/auth/refresh
# Search / filtering
GET /api/v1/posts?status=published&author=123&sort=-created_at&page=2&limit=20
Status Codes
200 OK — GET/PATCH/PUT success with body
201 Created — POST success (include Location header)
204 No Content — DELETE success
400 Bad Request — Invalid input (validation error)
401 Unauthorized — Not authenticated (no/invalid token)
403 Forbidden — Authenticated but not allowed
404 Not Found — Resource doesn't exist
409 Conflict — Duplicate email, version conflict
422 Unprocessable — Semantically invalid (used by FastAPI for validation)
429 Too Many Reqs — Rate limit exceeded
500 Server Error — Unexpected error (never expose details)
Request / Response Format
// List response with pagination
{
"data": [...],
"pagination": {
"total": 248,
"page": 2,
"limit": 20,
"has_next": true
}
}
// Single resource
{
"data": { "id": 1, "email": "[email protected]", "name": "Alice" }
}
// Error response (consistent across ALL endpoints)
{
"error": {
"code": "VALIDATION_ERROR",
"message": "Invalid input",
"details": [
{ "field": "email", "message": "Invalid email format" },
{ "field": "password", "message": "Must be at least 8 characters" }
]
}
}
Filtering & Pagination
# Filtering
GET /posts?status=published&tag=python&author_id=123
# Sorting (- prefix for DESC)
GET /posts?sort=-created_at,title
# Pagination
GET /posts?page=2&limit=20
# Field selection (reduce payload)
GET /users?fields=id,name,email
# Search
GET /posts?q=fastapi+tutorial
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 126 lines · 33 tokens per session scan A bfb57f041040
api-design is a skill published in the GitHub repository cohen-liel/hivemind (112 stars, last pushed 6mo ago), licensed Apache-2.0. It adds 33 tokens to every session and 919 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ring:migrating-to-lib-observability
Migrating a Lerian Go app off lib-commons observability imports (deprecated shims or removed APIs) to lib-observability via a fixed mapping table, then bumps go.mod and validates the build; ring:backend-go applies the edits. Covers log/zap/runtime/assert, opentelemetry/tracing, HTTP middleware, context helpers, and…
ring:using-lib-streaming
Using lib-streaming, Lerian's producer-only event publication library (Kafka/SQS/RabbitMQ/EventBridge), in two modes. Sweep Mode detects DIY publishers (franz-go, sarama, amqp091, watermill, raw AWS SDK) and re-rolled manifests/breakers. Reference Mode catalogs the Builder/Emitter/Catalog facade. Companion to…
ring:using-lib-systemplane
Using lib-systemplane, the hot-reload runtime-config plane (Postgres LISTEN/NOTIFY or MongoDB change streams), in two modes. Sweep Mode detects DIY config reload (SIGHUP, fsnotify, viper, pgx LISTEN), manual tenant-scoping, hand-built admin CRUD, and v4 residue. Reference Mode catalogs client lifecycle and…
ring:using-lib-observability
Using lib-observability v1.1.0, Lerian's OpenTelemetry foundation (lib-commons, lib-systemplane, lib-streaming depend on it), in two modes. Sweep Mode detects DIY zap/slog logging, raw OTel metrics, hand-rolled redaction, and hard-coded attribute strings. Reference Mode catalogs the log, metrics, zap, redaction, and…
ring:using-outbox
Using the transactional-outbox pattern across lib-streaming (writer) and lib-commons/v5/commons/outbox (repository + relay), in two modes. Sweep Mode detects DIY outbox tables, hand-rolled relay loops, send-and-pray emits, missing WithOutboxTx wrapping, and broker calls inside DB transactions. Reference Mode catalogs…
ring:using-tracing
Using lib-observability/tracing for OTEL provider lifecycle, trace-context propagation across HTTP/gRPC/queues, span error/event recording, and PII redaction, in two modes. Sweep Mode detects raw OTEL setup, hand-rolled header propagation, manual span-attribute assembly, and DIY redaction. Reference Mode catalogs…