api-platform-dto-resources

api-platform-dto-resources is a skill for Claude Code from dev-toolings/superpowers-symfony. It costs 49 tokens per session (576 once invoked), scanned A, original, MIT.

A guide for defining API data-transfer objects, which are separate shapes used to send data into and out of an API Platform application built with Symfony.

In plain words
What is it for?
Use it when designing or changing API operations, DTO mappings, providers, processors, validation rules, or access controls.
Why use it?
It keeps the public API contract separate from internal database entities, reducing accidental data exposure and mismatches between validation, security, and documentation.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

Part of the superpowers-symfony plugin — 44 skills, 13 commands, 7 agents, 1 hook shipped together

Good fit Use it when designing or changing API operations, DTO mappings, providers, processors, validation rules, or access controls.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/dev-toolings/superpowers-symfony/api-platform-dto-resources
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add dev-toolings/superpowers-symfony --skill api-platform-dto-resources
Clone the repo
git clone --depth 1 https://github.com/dev-toolings/superpowers-symfony

Made for: Claude Code.

Or install superpowers-symfony, the plugin that ships this one along with the rest of its 44 skills, 13 commands, 7 agents, 1 hook.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for api-platform-dto-resources

README.md
[![agentmods](https://agentmods.dev/badge/skills/dev-toolings/superpowers-symfony/api-platform-dto-resources/github.svg)](https://agentmods.dev/skills/dev-toolings/superpowers-symfony/api-platform-dto-resources)
Your own site
<a href="https://agentmods.dev/skills/dev-toolings/superpowers-symfony/api-platform-dto-resources"><img src="https://agentmods.dev/badge/skills/dev-toolings/superpowers-symfony/api-platform-dto-resources/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for api-platform-dto-resources

Your own site · 80×15
<a href="https://agentmods.dev/skills/dev-toolings/superpowers-symfony/api-platform-dto-resources"><img src="https://agentmods.dev/badge/skills/dev-toolings/superpowers-symfony/api-platform-dto-resources.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 49 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 576 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00049 $0.00576
Opus 5.5 $0.00020 $0.00230
Sonnet 5.5 $0.00010 $0.00115
Haiku 4.5 $0.00005 $0.00058

Measured 16d ago against content hash f405ebb8cc26, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

api-platform-dto-resources scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

5 near-identical copies found in the catalogue:

content/skills/api-platform-dto-resources/SKILL.md · 49 lines

What it actually says

Api Platform Dto Resources (Symfony)

Use when

  • The #[ApiResource] class must be the API contract, decoupled from the Doctrine entity.
  • Entity and API fields differ in name or format (rename, formatted price, computed value).
  • Create, update, or list operations need their own input or output shape.
  • Migrating code that relied on DataTransformerInterface, which no longer exists.

Default workflow

  1. Require symfony/object-mapper and set stateOptions: new Options(entityClass: ...) on the DTO resource.
  2. Bind the DTO and the entity with #[Map(source: ...)] and #[Map(target: ...)], and use #[Map(transform: ...)] for computed fields.
  3. For distinct shapes, create input and output classes and wire them with input: and output: on each operation.
  4. When mapping needs real logic, write a custom ProcessorInterface that calls ObjectMapperInterface::map().
  5. Test each operation: payload in, response shape out.

Guardrails

  • The automatic Object Mapper provider and processor only apply when stateOptions has an entityClass and both the DTO and the entity carry #[Map].
  • DataTransformerInterface is gone: use Object Mapper or a provider and processor.
  • No Object Mapper on 3.4 or on Symfony 6.4 LTS (it needs Symfony 7.3+): map manually in a ProviderInterface and a ProcessorInterface.
  • ObjectMapperProcessor is removed in 5.0: the automatic path uses ObjectMapperInputProcessor and ObjectMapperOutputProcessor (4.3+).
  • Never return the entity itself from a DTO resource: only mapped fields reach the client.

Progressive disclosure

  • Use this file for execution posture and risk controls.
  • Open references when deep implementation details are needed.

Output contract

  • The resource, input, and output classes with their #[Map] bindings.
  • The mapping path chosen (Object Mapper or custom processor) and why.
  • Tests showing the request and response shape of each operation.

References

  • reference.md
Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 16d ago Changed · +4 lines · +12 tokens per session f405ebb8cc26
  2. 1mo ago Changed · +3 lines · -3 tokens per session 904b2cc14921
  3. 1mo ago First seen · 42 lines · 40 tokens per session scan A 6d4644d18767

Subscribe to this mod's changes

api-platform-dto-resources is a skill published in the GitHub repository dev-toolings/superpowers-symfony (226 stars, last pushed 16d ago), licensed MIT. It adds 49 tokens to every session and 576 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

spine-design

Produce a system design doc — components, data flow, decisions made, tradeoffs, failure modes. Not a list of options. An actual design with calls made. Use when asked for "system design for", "architect this", "how should we build", or "design the backend".

tonone-ai/tonone · 62 tokens

warden-harden

Produce a hardening spec and implement it — auth patterns, security headers, rate limiting, input validation, secrets management, dependency hygiene. Use when asked to "harden this", "add security to this service", "what security do I need", or "secure this before launch".

tonone-ai/tonone · 61 tokens

cortex-integrate

Design and implement an AI feature integration — model selection, architecture pattern, system prompt, data flow, error handling, cost estimate. Use when asked to "add AI to this", "LLM integration", "add Claude/GPT", or "AI-powered feature".

tonone-ai/tonone · 58 tokens

spine-api

Design and spec an API — endpoints, request/response shapes, error codes, auth pattern, pagination. Applies Stripe's consistency principles. Use when asked to "design an API", "build API endpoints", "create REST API", or "API for this feature".

tonone-ai/tonone · 57 tokens

spine-review

API and backend code review — REST conventions, auth, validation, error handling, pagination, rate limiting, test coverage. Use when asked to "review this API", "code review", "review backend", or "pre-launch backend check".

tonone-ai/tonone · 52 tokens

spine-perf

Find and fix performance bottlenecks — N+1 queries, missing indexes, sync bottlenecks, caching gaps. Use when asked "why is this slow", "performance issue", "optimize this endpoint", or "N+1 queries".

tonone-ai/tonone · 55 tokens