Start with contracts, not endpoints
Treat your public API as a product: stable shapes, explicit error models, and documented deprecation windows beat ad-hoc JSON that “worked in Postman.”
Version intentionally (URL or header) and avoid breaking changes in patch releases. Clients should trust upgrades.
Pagination and limits
Cursor-based pagination scales better than naive offset for large datasets. Enforce sane max page sizes to protect your database and your users’ patience.
Idempotency and retries
Network clients retry. Make mutating operations safe with idempotency keys or natural idempotence so double-submits don’t double-charge or double-ship.