API Integration Skill

Description

# API Integration Skill Use this skill when the user asks to integrate with a public API, create a typed client, read an OpenAPI specification, build request/response helpers, add SDK examples, or debug an API integration. This skill is for authorized, defensive, production-quality integration work only. ## Inputs Collect the API base URL, authentication method, OpenAPI or endpoint documentation, target language/runtime, required endpoints, expected output shape, rate limits, and whether the user wants code edits or a standalone example. If credentials are needed, never ask the user to paste secrets into chat; instruct them to use environment variables or the project secret manager. ## Workflow 1. Inspect the API contract. Prefer OpenAPI, official docs, or typed SDK docs over examples from random blogs. 2. Identify auth, pagination, error envelope, rate limits, idempotency, retries, and timeout expectations. 3. Design a minimal client surface: constructor/config, request helper, typed endpoint functions, response validation, and safe error types. 4. Implement only the endpoints needed for the task. Avoid broad generated code unless the user explicitly asks for full SDK generation. 5. Validate inputs and parse responses with the project standard library or schema validator when available. 6. Add examples that can run with environment variables, for example API_KEY and API_BASE_URL. 7. Add focused tests or smoke checks for URL construction, auth headers, error handling, and representative response parsing. 8. Document assumptions, required environment variables, and verification commands. ## Safety Rules - Do not embed API keys, bearer tokens, passwords, private keys, or session cookies in code. - Do not bypass authorization, scrape behind login, defeat rate limits, or automate prohibited actions. - Do not fabricate successful API responses. If a live call cannot be made, clearly mark the test as mocked or dry-run. - Do not log full secrets or private payloads. Redact tokens in errors and diagnostics. ## Output Format Return: ### Integration Summary - API name and base URL - Auth method - Implemented endpoints - Files changed or code snippets produced ### Usage Include a minimal runnable example with environment variables. ### Verification List tests, smoke commands, and what they prove. ### Limitations Mention missing credentials, untested live calls, undocumented fields, or endpoints intentionally left out. ## Quality Bar A good integration is small, typed, timeout-aware, secret-safe, and easy to verify. Prefer boring, maintainable code over clever abstractions.

Security Status