API design checklist for production

Versioned contracts, request validation, typed error envelopes, request IDs and safe exception mapping
Pagination, field selection, bounded page sizes — no unbounded lists or exports
Safe CORS (exact allowlist), CSRF protection where relevant, webhook authentication and replay windows
Per-user and per-tenant authorization on every record — including server actions and batch endpoints
Idempotent mutations and optimistic concurrency for edits
HTTP caching with ETags where safe, stable error codes and backward compatibility
Per-tenant quotas and rate limits

Verify with contract tests so external consumers don't break silently.

API design checklist for production?