api

Plugin api in Adminhead/claude-plugins. Commands read from the repo's manifest — today.

Skills (8)

• graphql

  Design and review a public GraphQL API: whether GraphQL fits at all, schema naming and nullability, the Node interface, input and payload types, Relay cursor connections, typed error results, depth, breadth and cost ceilings, introspection, the federation trust boundary, and persisted-query policy.

• grpc

  Design and review gRPC and protobuf contracts: whether gRPC belongs at the edge at all, AIP package and versioning conventions, buf lint and breaking gates, compatibility review of .proto diffs across wire, ProtoJSON, generated code, and behavior, unary-by-default streaming, google.rpc.Status errors

• idempotency-retry

  Design idempotency keys and safe retries for HTTP APIs, on both sides - client-minted keys scoped per account, payload-mismatch rejection, an atomic claim in the database, absent, in-flight, and complete states with recovery jobs, replay windows - and client retry policy with an allowlist, full-jitt

• keys

  Design the API-key system a platform issues to its own API consumers: key format with prefix and checksum, hash-only storage and lookup, scopes, dual-key rotation, last-used telemetry, service-account ownership, and offboarding. Use when building or hardening key issuance for a public or partner API

• oauth-provider

  Design the OAuth 2.1 authorization-server side of an API: grant and PKCE profile per RFC 9700, redirect matching, token lifetimes, refresh rotation with reuse detection, scope taxonomy and token-type binding, consent screens with partial grants, client registration, and discovery metadata. Use when

• rest-design

  Design and review REST/HTTP API contracts for external consumers - resource and method semantics, status codes, one RFC 9457 error envelope, pagination, filtering, rate-limit signaling, and Hyrum's-Law compatibility - and run a contract-first workflow with OpenAPI, linting, contract tests, and two-w

• versioning

  Define an API versioning and deprecation policy - a written breaking-change definition, version scheme choice (URI path, header, date-pinned, or additive-only), notice windows by audience, Deprecation and Sunset headers, enforcement at the sunset date (410 Gone with a successor link versus fall-forw

• webhooks

  Design the provider side of outbound webhooks - the event catalog, thin or full payloads, Standard Webhooks signing with timestamp replay protection and secret rotation, at-least-once delivery with per-endpoint isolation, exponential backoff, dead-lettering and auto-disable, SSRF defenses, subscript