Return boring, predictable JSON
Prefer { items, total, page, limit } over reinventing pagination every endpoint. Keep field names stable; add fields, do not rename casually.
Errors should include a machine code and a human message. Status codes still matter — do not put everything in 200.
Auth and public surfaces
Never leak draft or private fields on public list endpoints. Filter at the query layer, not only in the UI.
Contract tests beat hope
A small suite that asserts response shapes catches breaking changes before marketing pages go blank.
#api#backend#contracts