Openapi

Output Format

.claude/feature-workspace/openapi-[resource].yaml and .claude/feature-workspace/api-design-notes.md

# API Design Notes: [Resource]

## Design Decisions
| Decision | Rationale |
|---|---|
| POST /sessions not /login | Resource-oriented — session is the resource |
| 429 with Retry-After | Communicates lockout duration without revealing account state |

## Security Surface
- [Auth required: yes/no + mechanism]
- [User enumeration risk: addressed how]
- [Rate limiting: yes/no + threshold]

## Breaking Change Assessment
- Additive only: yes/no
- Breaking changes: [list — requires version bump]

## Sunday Framework Mapping
- Client class: `[ClassName]` extends `BaseApiClient`
- Zod schema: `[SchemaName]` validates response shape
- Auth provider: `[Provider]`

Guardrails

• Never return error messages that reveal whether an account exists (user enumeration).
• Every collection endpoint must have pagination.
• Every mutation must specify idempotency strategy.
• OpenAPI spec must be shown to the user for approval before being written to disk.
• Never use 200 for error responses.

Standalone Mode

Pure design reasoning. No external tools required. Produces YAML spec locally.