API Audit

REST API pattern validation with 55+ checks across 9 categories. Use /api-audit:run to audit your API endpoints for best practices and common mistakes.

What It Checks (55+ checks)

Route Structure & Naming (8 checks)

• RESTful resource naming (plural nouns, no verbs)
• Consistent URL casing (kebab-case recommended)
• Nested resource depth (max 2-3 levels)
• Route parameter naming consistency
• No file extensions in URLs
• Consistent base path prefix (/api/v1/)
• No trailing slashes inconsistency
• Route grouping by resource

HTTP Methods & Status Codes (8 checks)

• Correct HTTP method per operation (GET=read, POST=create, etc.)
• Appropriate status codes (201 for create, 204 for delete, etc.)
• No GET requests with body payload
• HEAD/OPTIONS support for CORS
• 404 for missing resources (not 200 with empty body)
• 409 for conflicts, 422 for validation errors
• 429 for rate limit exceeded
• 5xx only for server errors (not validation)

Error Response Format (6 checks)

• Consistent error response structure
• Machine-readable error codes
• Human-readable error messages
• No stack traces in production responses
• Validation errors include field-level details
• Error response includes request ID for debugging

Authentication & Authorization (7 checks)

• Auth middleware on protected routes
• No auth secrets in query parameters
• Bearer token / API key pattern
• Role-based access control consistency
• Auth errors return 401 (not 403) for missing auth
• 403 for insufficient permissions
• Token refresh endpoint exists

Input Validation (6 checks)

• Request body validation (Zod, Joi, class-validator)
• Query parameter validation and sanitization
• Path parameter type validation
• File upload size/type restrictions
• SQL injection prevention (parameterized queries)
• XSS prevention (output encoding)

Rate Limiting & Throttling (4 checks)

• Rate limiting middleware configured
• Rate limit headers in responses (X-RateLimit-*)
• Different limits per endpoint sensitivity
• Retry-After header on 429 responses

Pagination & Filtering (6 checks)

• List endpoints support pagination
• Consistent pagination pattern (cursor vs offset)
• Default and max page size limits
• Total count in response or Link headers
• Sorting parameter support
• Filter parameter validation

Documentation & Discovery (5 checks)

• OpenAPI/Swagger spec exists
• Spec matches actual routes
• API changelog/versioning
• Health check endpoint
• API documentation accessible

Logging & Monitoring (5 checks)

• Request/response logging configured
• Sensitive data excluded from logs
• Request ID propagation
• Response time tracking
• Error rate monitoring hooks