API Best Practices Checklist

API Design Checklist

• Use HTTPS always — never HTTP in production
• Version from day 1 — /v1/ in the URL
• Plural nouns — /users not /user
• Correct HTTP verbs — GET/POST/PUT/PATCH/DELETE
• Precise status codes — 201 created, 204 delete, 422 validation
• Consistent error format — code + message + field
• Paginate all list endpoints
• Rate limit all endpoints — 429 with Retry-After
• Document with OpenAPI — Swagger UI at /docs
• Idempotency keys for payments and critical POST operations
• Input validation on every field
• CORS configured for your frontend origin
• Health check at /health for load balancers
• Request IDs — X-Request-ID for distributed tracing