A skill for Claude Code and Codex · Software and infrastructure
api-expert is the skill that has your AI build, audit, and scale backend APIs in Express 5, NestJS 11, or FastAPI as a stack of layers: edge, application, data, out-of-request work, and everything cross-cutting, with OWASP API Top 10, caching, queues, rate limiting, observability, and unhappy-path testing. Not just working, but holding up under real users.
Solo skill: unlocks right away, no guarantee after download. Purchase terms.
Or get all 25 skills plus 9 bonuses in the Supreme Pack for R$ 497.
The problem
An AI-generated API is usually born pretty and fragile: it returns the entire database entity, trusts whatever id the client sends, and does everything inside the request. Three symptoms, and what changes with the skill.
| Without the skill | With api-expert |
|---|---|
| The order route returns anyone's order to whoever swaps the number in the URL, because nobody checked whether that id belongs to the logged-in user. | Object-level authorization on every route that takes an identifier, which is OWASP API's number-one failure, tested with the wrong user trying to get in. |
| Listings with no pagination, the entire entity in the response with internal fields tagging along, and email, PDF, and integration work all running inside the user's request. | Mandatory pagination, responses trimmed to only what's needed, and every slow task moved to a queue while the request responds fast. |
| A slow external API locks up everything because there's no timeout, and brute force on the login goes unnoticed because there's no rate limit and no log. | Timeouts on every external call, tighter rate limits on authentication and expensive routes, structured logs with a correlation id, and a health check. |
What you get out of it
An API with the right layers for your case, and the production checklist closed out before it ships.
NestJS, Express, or FastAPI, based on load, team, and project
edge validation, object-level authorization, headers, restricted CORS, and errors with no stack trace
layered caching, a queue for slow work, a database connection pool, and lean payloads
what to check before going live, and the anti-patterns that take APIs down
How it works
New API or an existing one, framework, expected load, reads versus writes, audience and multi-tenancy, and whether the real bottleneck is latency, security, or cost.
NestJS for structure and TypeScript teams, Express for a simple API, FastAPI for Python teams, and no swapping frameworks before getting the basics right.
Edge, application, data, queue, and cross-cutting concerns, reading the reference for each topic instead of dumping everything into the project at once.
Errors with stable codes, cancellations that don't turn into automatic retries, request bodies validated at the boundary, and the contract checked end to end.
Production checklist and anti-pattern catalog before calling the API done, with tests for authorization and invalid input.
Before you buy
Its limits
The skill makes sure the API is fast, secure, and cheap to run, but business rules, domain modeling, and what each endpoint should do are still your project's call.
Scaling infrastructure with a load balancer, replicas, and orchestration is escala's job, and measuring how much the API can take is teste-de-carga's, both in the catalog.
It covers REST, GraphQL, and webhooks, and helps you decide between them. gRPC shows up only as a reference for when to consider it.
What you receive
The price
Just api-expert
R$57one time payment
Bought it solo and now want it all? Message me on WhatsApp and I will deduct what you already paid.
Supreme Pack
R$ 1.665R$497or 10x on a card
Buying all 25 solo adds up to R$ 1.665. The pack pays for itself by the ninth skill. See everything the Supreme Pack includes
04 · Software and infrastructure
Before you ask
It works for all three: Express 5, NestJS 11, and FastAPI. The security, caching, queue, and observability principles apply equally, and each framework has its own reference with up-to-date code.
It defines the strategy and requires unhappy-path testing, like the wrong user accessing someone else's id, or input that should never trigger a 500 error. To build and run the entire suite, testes-automatizados-expert is in the catalog.
No. Validation, object-level authorization, pagination, and timeouts pay off from the very first route, and cost a lot less to add early than later.
Yes. With the repository open, it diagnoses where it hurts, applies only the layers that are missing, and closes it out with the checklist.
Yes, the license covers your work for third parties. What's off limits is reselling or redistributing the skill.
One-time payment, 12 months of updates. No refunds after download; the Supreme Pack comes with a 7-day guarantee.
