API design checklist

• Use resource-oriented names and consistent HTTP semantics where appropriate.
• Validate input at the boundary and return stable error formats.
• Define authentication, authorization, rate limits, and request size limits.
• Use pagination for potentially large result sets.
• Use idempotency keys for retryable operations that must not create duplicate effects.
• Version APIs when changes are not backward compatible.
• Set explicit timeouts and define retry behavior for clients.

Pagination choices

• Offset pagination: easy to understand; large offsets can be expensive and results can shift during concurrent writes.
• Cursor pagination: better for large or changing datasets when backed by a stable indexed sort key; requires cursor management.

Data modeling checklist

• Start from access patterns and query requirements.
• Identify entities, relationships, uniqueness constraints, and lifecycle rules.
• Define indexes for actual query patterns and sort orders.
• Consider write amplification, index size, hot keys, and data growth.
• Decide which data is authoritative and which is derived.

Example: order creation POST /orders should validate the cart, verify pricing and inventory according to business rules, and use a durable transaction or workflow where necessary. A client retry should not accidentally create multiple orders; an idempotency key can bind retries to the original result.

Avoid: exposing internal database schemas directly as public API contracts, allowing unbounded list endpoints, and relying on client-side validation for security.