Skip to main content
Batoi RAD Docs

API Design and Security

Publish stable APIs with explicit authentication, validation, errors, and rate boundaries.

Version 1.x Active framework documentation Reviewed Jul 21, 2026 Next review Oct 21, 2026
Start Reading Open Batoi RAD GitHub Report documentation issue

Owner: Batoi Engineering Reviewed by: Batoi RAD Maintainers Source revision: bb9902c

Browse Batoi RAD Documentation API Design and Security
On this page

API Design and Security

An API should expose a durable business contract rather than mirror internal tables or route implementation.

Contract Checklist

  • Use resource-oriented paths and stable opaque identifiers.
  • Authenticate before loading protected data.
  • Apply workspace and object authorization to every operation.
  • Validate types, length, format, allowed values, and cross-field rules.
  • Return consistent success and error envelopes.
  • Paginate registers and bound expensive filters or exports.
  • Make retry behavior and idempotency explicit for consequential writes.
  • Version breaking contract changes deliberately.

Do not expose stack traces, SQL, filesystem paths, credentials, configuration values, or internal exception details. Log a correlation identifier server-side and return a safe error to the caller.