.NET API Review

Use this skill when reviewing ASP.NET Core APIs. It is also SkillForge's own documentation example, so it is written the way a real, useful skill should be.

Goals

• Detect backward compatibility risks before they reach a published contract.
• Review authentication and authorization on every reachable endpoint.
• Identify performance bottlenecks in persistence access.
• Produce findings a developer can act on without further investigation.

Workflow

1. Inventory the surface. List controllers, minimal API endpoints and their routes. Note which are

anonymous.

1. Review contracts. For each request and response type, check whether a change would break an

existing client: removed fields, narrowed types, changed enum values, altered status codes.

1. Review authentication. Confirm every endpoint either requires authorization or is deliberately

anonymous. Treat a missing attribute as anonymous, not as an oversight to assume away.

1. Review persistence. Look for N+1 access patterns, queries without pagination, and unbounded

result sets.

1. Report findings ordered by severity, each with the file, the risk, and the smallest change that

resolves it.

What not to do

• Do not rewrite the API's architecture as part of a review.
• Do not report style preferences as risks.
• Do not claim an endpoint is secure. Report what was checked and what was found.

References

• API versioning notes