spring-boot-rest-api-standards

REST API design standards and best practices for Spring Boot projects, intended for use when creating or reviewing endpoints, DTOs, error handling, pagination, and security configuration. It lays out resource-based URL design (plural nouns, conventions like GET /users and POST /users, avoiding action URLs such as /getUserList), correct use of HTTP methods with their safety and idempotency semantics, and an appropriate mapping of status codes (200, 201 with a Location header, 204, 400, 404, 409, 500). Request and response DTOs are recommended to separate API contracts from domain entities, implemented as Java records or Lombok @Data/@Value types and annotated with Jakarta validation constraints such as @NotBlank, @Email, and @Size, applied through @Valid on @RequestBody parameters. Error handling is centralized with a @RestControllerAdvice global handler that returns standardized responses (status, error, message, timestamp) and handles MethodArgumentNotValidException and ResponseStatusException. Pagination guidance uses Spring's Pageable with page, size, and sort parameters and returns metadata like total elements and total pages, and security guidance covers CORS, content security policy, and headers such as X-Frame-Options and X-Content-Type-Options. Worked examples include a full CRUD controller, request/response DTOs, and a global exception handler, plus best practices for constructor injection, immutable DTOs, and transaction management with @Transactional (including readOnly queries). The skill defines validation checkpoints between steps and a set of constraints and warnings — never expose entities directly, follow REST conventions, handle all exceptions globally, always paginate large result sets, validate all input, and never expose sensitive data such as passwords, tokens, or PII. A references directory and pointers to related dependency-injection and test-pattern skills provide further material.