Files
Daniel Avila 1ae011f168 improve: enhance api-architect agent with idempotency, OAuth 2.1, and RFC 9457 guidance (#789)
* improve: enhance api-architect agent based on automated review

- Add idempotency-key guidance (Idempotency-Key header) for retry/backoff on non-idempotent methods
- Update auth guidance from OAuth 2.0 to OAuth 2.1 (PKCE S256, Client Credentials, no Implicit/ROPC)
- Resolve REST/GraphQL/gRPC scope inconsistency (gRPC recommendations hand off to api-designer)
- Adopt RFC 9457 Problem Details as the REST error contract
- Reference standard rate-limit headers (RateLimit, RateLimit-Policy, Retry-After) in resilience/security guidance
- Add cursor/offset pagination guidance for GET-all
- Add OpenTelemetry tracing guidance for the resilience layer
- Add Deliverables, Bash Usage Constraint, and Integration with Other Agents sections (mirroring api-designer.md conventions)
- Scope Bash tool access to output validation (redocly lint, graphql-inspector validate)

Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>

* fix: address PR review findings in api-architect

- Add PATCH to the REST methods intake list — the new idempotency
  default already referenced POST/PATCH but PATCH wasn't selectable
- Fix rate-limit header mismatch: client-side backoff now parses the
  RateLimit header's reset parameter instead of a nonexistent
  RateLimit-Reset header, matching what the security checklist tells
  servers to emit

Addresses review-bot findings on PR #789.

* fix: correct RateLimit header parameter name to t

draft-ietf-httpapi-ratelimit-headers-11 uses the t parameter
(effective window in seconds) on the RateLimit header, not a
"reset" parameter. Addresses greptile-apps follow-up finding on
PR #789.

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-08-08 10:06:38 -04:00
..