{"id":"8d7f965a-6594-43f7-9ad0-dbc65287bcfe","entityType":"agent","slug":"clawhub-skills-1kalin-afrexai-api-architect","name":"afrexai-api-architect","canonicalUrl":"https://www.xpersona.co/agent/clawhub-skills-1kalin-afrexai-api-architect","canonicalPath":"/agent/clawhub-skills-1kalin-afrexai-api-architect","generatedAt":"2026-10-09T15:06:37.850Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"description":"Design, build, test, document, and secure production-grade APIs. Covers the full lifecycle from schema design through deployment, monitoring, and versioning. Use when designing new APIs, reviewing existing ones, generating OpenAPI specs, building test suites, or debugging production issues. --- name: afrexai-api-architect description: Design, build, test, document, and secure production-grade APIs. Covers the full lifecycle from schema design through deployment, monitoring, and versioning. Use when designing new APIs, reviewing existing ones, generating OpenAPI specs, building test suites, or debugging production issues. metadata: {\"openclaw\":{\"os\":[\"linux\",\"darwin\",\"win32\"]}} --- API Architect — Full L","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. Last updated 4/15/2026.","installCommand":"clawhub skill install skills:1kalin:afrexai-api-architect","sourceUrl":"https://github.com/openclaw/skills/tree/main/skills/1kalin/afrexai-api-architect","homepage":null,"primaryLinks":[{"label":"View on ClawHub","url":"https://github.com/openclaw/skills/tree/main/skills/1kalin/afrexai-api-architect","kind":"source"}],"safetyScore":84,"overallRank":62,"popularityScore":50,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Design, build, test, document, and secure production-grade APIs. Covers the full lifecycle from schema design through deployment, monitoring, and versioning. Us"},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[{"label":"be","status":"self-declared"},{"label":"only","status":"self-declared"},{"label":"email","status":"self-declared"}],"verifiedCount":0,"selfDeclaredCount":4,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"},{"key":"be","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"},{"key":"only","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"},{"key":"email","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile capability:be|supported|profile capability:only|supported|profile capability:email|supported|profile"}},"adoption":{"evidence":{"source":"no-adoption-signals","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"No source adoption metrics were available."},"stars":null,"forks":null,"downloads":null,"packageName":null,"latestVersion":null,"tractionLabel":null},"release":{"evidence":{"source":"agent-index","verified":false,"confidence":"medium","updatedAt":"2026-02-25T06:16:55.942Z","emptyReason":null},"lastUpdatedAt":"2026-04-15T00:45:39.800Z","lastCrawledAt":"2026-02-25T06:16:55.942Z","lastIndexedAt":null,"nextCrawlAt":"2026-02-26T06:16:55.942Z","lastVerifiedAt":null,"highlights":[]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install skills:1kalin:afrexai-api-architect","setupComplexity":"low","setupSteps":["Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-api-architect/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-api-architect/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-api-architect/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-api-architect/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-api-architect/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-api-architect/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-09T15:06:37.850Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-api-architect/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-api-architect/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-api-architect/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-api-architect/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"readme":"---\nname: afrexai-api-architect\ndescription: Design, build, test, document, and secure production-grade APIs. Covers the full lifecycle from schema design through deployment, monitoring, and versioning. Use when designing new APIs, reviewing existing ones, generating OpenAPI specs, building test suites, or debugging production issues.\nmetadata: {\"openclaw\":{\"os\":[\"linux\",\"darwin\",\"win32\"]}}\n---\n\n# API Architect — Full Lifecycle API Development\n\nDesign, build, test, document, secure, and monitor production-grade APIs. Not just curl commands — a complete engineering methodology.\n\n## When to Use\n\n- Designing a new API (REST, GraphQL, or gRPC)\n- Reviewing an existing API for quality, consistency, or security\n- Generating or validating OpenAPI/Swagger specs\n- Building comprehensive test suites (unit, integration, contract, load)\n- Debugging production API issues\n- Planning API versioning and deprecation\n- Setting up monitoring, rate limiting, and error handling\n\n---\n\n## Phase 1: API Design\n\n### Design-First Approach\n\nAlways design before coding. The spec IS the contract.\n\n#### Resource Modeling\n\nMap your domain to resources using this template:\n\n```yaml\n# api-design.yaml\nservice: order-management\nbase_path: /api/v1\nresources:\n  - name: orders\n    path: /orders\n    description: Customer purchase orders\n    identifier: order_id (UUID)\n    parent: null\n    operations: [list, create, get, update, cancel]\n    sub_resources:\n      - name: line_items\n        path: /orders/{order_id}/items\n        operations: [list, add, update, remove]\n      - name: payments\n        path: /orders/{order_id}/payments\n        operations: [list, create, get, refund]\n    states: [draft, confirmed, processing, shipped, delivered, cancelled]\n    transitions:\n      - from: draft → to: confirmed (action: confirm)\n      - from: confirmed → to: processing (action: process)\n      - from: processing → to: shipped (action: ship)\n      - from: shipped → to: delivered (action: deliver)\n      - from: [draft, confirmed] → to: cancelled (action: cancel)\n```\n\n#### Naming Conventions Checklist\n\n| Rule | Good | Bad |\n|------|------|-----|\n| Plural nouns for collections | `/users` | `/user`, `/getUsers` |\n| Kebab-case for multi-word | `/line-items` | `/lineItems`, `/line_items` |\n| No verbs in URLs | `POST /orders` | `/createOrder` |\n| Nest for ownership | `/users/123/orders` | `/orders?user=123` (for primary relationship) |\n| Max 3 levels deep | `/users/123/orders` | `/users/123/orders/456/items/789/options` |\n| Filter via query params | `/orders?status=active` | `/active-orders` |\n| Actions as sub-resource | `POST /orders/123/cancel` | `PATCH /orders/123 {cancelled:true}` |\n\n#### HTTP Methods — Decision Matrix\n\n```\nNeed to...                          → Method   Idempotent?  Safe?\nGet a resource or collection        → GET      Yes          Yes\nCreate a new resource               → POST     No           No\nFull replace of a resource          → PUT      Yes          No\nPartial update of a resource        → PATCH    No*          No\nRemove a resource                   → DELETE   Yes          No\nCheck if resource exists            → HEAD     Yes          Yes\nList allowed methods                → OPTIONS  Yes          Yes\n\n* PATCH can be idempotent if using JSON Merge Patch\n```\n\n#### Status Code Decision Tree\n\n```\nSuccess?\n├── Created something new? → 201 Created (Location header)\n├── Accepted for async processing? → 202 Accepted (include status URL)\n├── No body to return? → 204 No Content\n└── Returning data? → 200 OK\n\nClient error?\n├── Malformed request syntax? → 400 Bad Request\n├── No/invalid credentials? → 401 Unauthorized\n├── Valid credentials but insufficient permissions? → 403 Forbidden\n├── Resource doesn't exist? → 404 Not Found\n├── Method not allowed on resource? → 405 Method Not Allowed\n├── Conflict with current state? → 409 Conflict\n├── Resource permanently gone? → 410 Gone\n├── Validation failed? → 422 Unprocessable Entity\n├── Too many requests? → 429 Too Many Requests (Retry-After header)\n└── Precondition failed (etag mismatch)? → 412 Precondition Failed\n\nServer error?\n├── Unexpected failure? → 500 Internal Server Error\n├── Upstream dependency failed? → 502 Bad Gateway\n├── Temporarily overloaded? → 503 Service Unavailable (Retry-After)\n└── Upstream timeout? → 504 Gateway Timeout\n```\n\n### Request/Response Design\n\n#### Standard Response Envelope\n\n```json\n// Success (single resource)\n{\n  \"data\": { \"id\": \"ord_abc123\", \"status\": \"confirmed\", ... },\n  \"meta\": { \"request_id\": \"req_xyz789\" }\n}\n\n// Success (collection)\n{\n  \"data\": [ ... ],\n  \"meta\": { \"request_id\": \"req_xyz789\" },\n  \"pagination\": {\n    \"total\": 142,\n    \"page\": 2,\n    \"per_page\": 20,\n    \"total_pages\": 8,\n    \"next\": \"/api/v1/orders?page=3&per_page=20\",\n    \"prev\": \"/api/v1/orders?page=1&per_page=20\"\n  }\n}\n\n// Error\n{\n  \"error\": {\n    \"code\": \"VALIDATION_FAILED\",\n    \"message\": \"Request validation failed\",\n    \"details\": [\n      { \"field\": \"email\", \"message\": \"Must be a valid email address\", \"code\": \"INVALID_FORMAT\" },\n      { \"field\": \"age\", \"message\": \"Must be at least 18\", \"code\": \"MIN_VALUE\", \"min\": 18 }\n    ]\n  },\n  \"meta\": { \"request_id\": \"req_xyz789\" }\n}\n```\n\n#### Pagination Patterns — When to Use Which\n\n| Pattern | Use When | Pros | Cons |\n|---------|----------|------|------|\n| **Offset** `?page=2&per_page=20` | Simple UI pagination, small datasets | Easy to implement, page jumping | Drift on inserts, slow on large offsets |\n| **Cursor** `?after=eyJ...&limit=20` | Infinite scroll, real-time feeds, large datasets | Consistent, performant | No page jumping, opaque cursors |\n| **Keyset** `?created_after=2024-01-01&limit=20` | Time-series data, logs | Fast, transparent | Requires sortable field, no count |\n\n#### Filtering, Sorting, Field Selection\n\n```\n# Filtering\nGET /orders?status=active&created_after=2024-01-01&total_min=100\n\n# Sorting (prefix - for descending)\nGET /orders?sort=-created_at,total\n\n# Field selection (reduce payload)\nGET /orders?fields=id,status,total,customer.name\n\n# Search\nGET /products?q=wireless+headphones\n\n# Combined\nGET /orders?status=active&sort=-created_at&fields=id,status,total&page=1&per_page=10\n```\n\n---\n\n## Phase 2: OpenAPI Specification\n\n### Generate OpenAPI 3.1 Spec\n\nFor each resource in your design, generate a complete spec:\n\n```yaml\nopenapi: 3.1.0\ninfo:\n  title: Order Management API\n  version: 1.0.0\n  description: |\n    Order lifecycle management.\n    \n    ## Authentication\n    All endpoints require Bearer token authentication.\n    \n    ## Rate Limits\n    - Standard: 100 req/min\n    - Bulk operations: 10 req/min\n  contact:\n    name: API Support\n    email: api@example.com\n  license:\n    name: MIT\nservers:\n  - url: https://api.example.com/v1\n    description: Production\n  - url: https://staging-api.example.com/v1\n    description: Staging\n\npaths:\n  /orders:\n    get:\n      operationId: listOrders\n      summary: List orders\n      tags: [Orders]\n      parameters:\n        - $ref: '#/components/parameters/PageParam'\n        - $ref: '#/components/parameters/PerPageParam'\n        - name: status\n          in: query\n          schema:\n            $ref: '#/components/schemas/OrderStatus'\n        - name: created_after\n          in: query\n          schema:\n            type: string\n            format: date-time\n      responses:\n        '200':\n          description: Order list\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/OrderListResponse'\n        '401':\n          $ref: '#/components/responses/Unauthorized'\n\n    post:\n      operationId: createOrder\n      summary: Create an order\n      tags: [Orders]\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/CreateOrderRequest'\n            examples:\n              basic:\n                summary: Basic order\n                value:\n                  customer_id: \"cust_abc\"\n                  items:\n                    - product_id: \"prod_xyz\"\n                      quantity: 2\n      responses:\n        '201':\n          description: Order created\n          headers:\n            Location:\n              schema:\n                type: string\n              description: URL of created order\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/OrderResponse'\n        '422':\n          $ref: '#/components/responses/ValidationError'\n\ncomponents:\n  securitySchemes:\n    BearerAuth:\n      type: http\n      scheme: bearer\n      bearerFormat: JWT\n\n  parameters:\n    PageParam:\n      name: page\n      in: query\n      schema: { type: integer, minimum: 1, default: 1 }\n    PerPageParam:\n      name: per_page\n      in: query\n      schema: { type: integer, minimum: 1, maximum: 100, default: 20 }\n\n  responses:\n    Unauthorized:\n      description: Missing or invalid authentication\n      content:\n        application/json:\n          schema:\n            $ref: '#/components/schemas/ErrorResponse'\n    ValidationError:\n      description: Request validation failed\n      content:\n        application/json:\n          schema:\n            $ref: '#/components/schemas/ErrorResponse'\n\nsecurity:\n  - BearerAuth: []\n```\n\n### Spec Quality Checklist (score each 0-2)\n\n| # | Check | Score |\n|---|-------|-------|\n| 1 | Every endpoint has operationId | /2 |\n| 2 | All parameters documented with types + constraints | /2 |\n| 3 | Request bodies have examples | /2 |\n| 4 | All error responses documented (400, 401, 403, 404, 422, 429, 500) | /2 |\n| 5 | Shared schemas use $ref (DRY) | /2 |\n| 6 | Pagination parameters standardized | /2 |\n| 7 | Security scheme defined + applied globally | /2 |\n| 8 | Description includes auth, rate limits, versioning info | /2 |\n| 9 | Response headers documented (Location, Retry-After, ETag) | /2 |\n| 10 | Enums used for fixed value sets | /2 |\n\n**Score: ___/20** (Target: 16+)\n\n---\n\n## Phase 3: Implementation Patterns\n\n### Request Validation Layer\n\nEvery endpoint MUST validate before processing:\n\n```\nValidation Order:\n1. Content-Type header (reject non-JSON early)\n2. Authentication (401 before wasting cycles)\n3. Authorization (403 - does this user have access?)\n4. Path parameters (404 - does the resource exist?)\n5. Query parameters (400 - valid types/ranges?)\n6. Request body schema (422 - valid structure?)\n7. Business rules (422 - valid state transition?)\n```\n\n### Error Handling — Standard Error Codes\n\nDefine a consistent error code enum for your API:\n\n```\n# Authentication & Authorization\nAUTH_REQUIRED          — No credentials provided\nAUTH_INVALID           — Invalid/expired credentials\nAUTH_INSUFFICIENT      — Valid credentials, wrong permissions\nAUTH_RATE_LIMITED       — Too many auth attempts\n\n# Validation\nVALIDATION_FAILED      — Generic validation error (see details array)\nINVALID_FORMAT         — Field format wrong (email, UUID, etc.)\nREQUIRED_FIELD         — Required field missing\nOUT_OF_RANGE           — Value outside allowed range\nINVALID_ENUM           — Value not in allowed set\n\n# Resource\nNOT_FOUND              — Resource doesn't exist\nALREADY_EXISTS         — Duplicate (unique constraint)\nCONFLICT               — State conflict (e.g., already cancelled)\nGONE                   — Resource permanently deleted\n\n# Business Logic\nINSUFFICIENT_FUNDS     — Payment-related\nQUOTA_EXCEEDED         — Usage limit reached\nFEATURE_DISABLED       — Feature flag off\nDEPENDENCY_FAILED      — Upstream service error\n\n# System\nINTERNAL_ERROR         — Unexpected server error\nSERVICE_UNAVAILABLE    — Temporarily down\nTIMEOUT                — Request took too long\n```\n\n### Idempotency\n\nFor non-idempotent operations (POST), require an idempotency key:\n\n```\nRequest:\nPOST /orders\nIdempotency-Key: ord_req_abc123\n\nServer behavior:\n1. Check if Idempotency-Key was seen before\n2. If yes → return cached response (same status, same body)\n3. If no → process request, cache response for 24h\n4. Key format: client-generated UUID or meaningful string\n```\n\n### Rate Limiting\n\nStandard headers to include:\n\n```\nX-RateLimit-Limit: 100          # Max requests per window\nX-RateLimit-Remaining: 67       # Remaining in current window\nX-RateLimit-Reset: 1706886400   # Unix timestamp when window resets\nRetry-After: 30                 # Seconds to wait (on 429)\n```\n\nRate limit tiers:\n\n| Tier | Limit | Window | Use Case |\n|------|-------|--------|----------|\n| Standard | 100/min | Sliding | Normal API calls |\n| Bulk | 10/min | Sliding | Batch operations |\n| Search | 30/min | Sliding | Full-text search |\n| Auth | 5/min | Fixed | Login attempts |\n| Webhook | 1000/min | Sliding | Incoming webhooks |\n\n---\n\n## Phase 4: Testing Strategy\n\n### Test Pyramid for APIs\n\n```\n        /  E2E  \\          — 5-10 critical user flows\n       / Contract \\        — Schema validation, backward compat\n      / Integration \\      — Database, external services, auth\n     /    Unit Tests  \\    — Business logic, validation, transforms\n    ‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾\n```\n\n### Test Checklist Per Endpoint\n\nFor EVERY endpoint, test these scenarios:\n\n```yaml\nendpoint: POST /orders\ntests:\n  happy_path:\n    - Creates order with valid data → 201\n    - Returns created resource with ID\n    - Location header points to new resource\n    - Timestamps are set (created_at, updated_at)\n  \n  validation:\n    - Missing required fields → 422 with field-level errors\n    - Invalid field types (string where int expected) → 422\n    - Empty body → 400\n    - Invalid Content-Type → 415\n    - Extra unknown fields → ignored or 422 (pick one, be consistent)\n    - Boundary values (min/max length, 0, negative, empty string vs null)\n  \n  authentication:\n    - No token → 401\n    - Expired token → 401\n    - Invalid token → 401\n    - Valid token, wrong scope → 403\n  \n  authorization:\n    - User accessing own resource → 200\n    - User accessing other's resource → 403 or 404 (security choice)\n    - Admin accessing any resource → 200\n  \n  edge_cases:\n    - Duplicate creation (same idempotency key) → same 201 response\n    - Concurrent creation race condition → one wins, one gets 409\n    - Resource at max relationships → 422\n    - Unicode in text fields → handled correctly\n    - Very long strings → 422 with max length error\n    - SQL injection in params → no effect (parameterized queries)\n    - XSS in text fields → stored safely, escaped on output\n  \n  performance:\n    - Response time < 200ms (p95)\n    - List endpoint with 10K records → paginated, < 500ms\n    - Bulk operation timeout handling\n```\n\n### curl Testing Recipes\n\n```bash\n# === Setup ===\nBASE=\"https://api.example.com/v1\"\nTOKEN=\"your_bearer_token\"\nalias api='curl -s -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\"'\n\n# === CRUD Lifecycle Test ===\n# Create\nORDER=$(api -X POST \"$BASE/orders\" -d '{\"customer_id\":\"cust_1\",\"items\":[{\"product_id\":\"prod_1\",\"qty\":2}]}')\nORDER_ID=$(echo \"$ORDER\" | jq -r '.data.id')\necho \"Created: $ORDER_ID\"\n\n# Read\napi \"$BASE/orders/$ORDER_ID\" | jq .\n\n# Update\napi -X PATCH \"$BASE/orders/$ORDER_ID\" -d '{\"notes\":\"Rush order\"}' | jq .\n\n# List with filters\napi \"$BASE/orders?status=draft&sort=-created_at&per_page=5\" | jq .\n\n# Action (state transition)\napi -X POST \"$BASE/orders/$ORDER_ID/confirm\" | jq .\n\n# Delete\ncurl -s -o /dev/null -w \"%{http_code}\" -X DELETE -H \"Authorization: Bearer $TOKEN\" \"$BASE/orders/$ORDER_ID\"\n\n# === Error Testing ===\n# No auth\ncurl -s \"$BASE/orders\" | jq .error\n\n# Invalid body\napi -X POST \"$BASE/orders\" -d '{\"invalid\": true}' | jq .error\n\n# Not found\napi \"$BASE/orders/nonexistent\" | jq .error\n\n# === Performance ===\n# Timing breakdown\ncurl -s -o /dev/null -w \"DNS:%{time_namelookup} TCP:%{time_connect} TLS:%{time_appconnect} TTFB:%{time_starttransfer} Total:%{time_total}\\n\" -H \"Authorization: Bearer $TOKEN\" \"$BASE/orders\"\n\n# Quick load test (50 requests, 10 concurrent)\nseq 50 | xargs -P10 -I{} curl -s -o /dev/null -w \"%{http_code} %{time_total}s\\n\" -H \"Authorization: Bearer $TOKEN\" \"$BASE/orders\"\n```\n\n### Contract Testing\n\nValidate your API hasn't broken backward compatibility:\n\n```yaml\n# contract-tests.yaml\ncontract:\n  name: Order API Contract\n  version: 1.0.0\n  \n  rules:\n    # These changes are SAFE (non-breaking)\n    safe:\n      - Adding new optional fields to responses\n      - Adding new endpoints\n      - Adding new optional query parameters\n      - Adding new enum values (if clients handle unknown)\n      - Widening a constraint (min: 5 → min: 1)\n    \n    # These changes are BREAKING\n    breaking:\n      - Removing a response field\n      - Renaming a response field\n      - Changing a field type\n      - Adding a new required request field\n      - Removing an endpoint\n      - Narrowing a constraint (max: 100 → max: 50)\n      - Changing error response format\n      - Removing an enum value\n    \n    # Verify after every change\n    checks:\n      - All existing fields still present in responses\n      - All existing field types unchanged\n      - All existing required fields still required (no more, no fewer)\n      - Default values unchanged\n      - Error format unchanged\n```\n\n---\n\n## Phase 5: Security\n\n### Security Checklist (audit every API)\n\n```yaml\nauthentication:\n  - [ ] All endpoints require auth (except /health, /docs, public webhooks)\n  - [ ] Tokens expire (short-lived access + long-lived refresh)\n  - [ ] Token rotation supported\n  - [ ] Failed auth returns 401 with no info leakage\n  - [ ] API keys are hashed in storage (never plain text)\n\nauthorization:\n  - [ ] Resource-level checks (user can only access their data)\n  - [ ] Endpoint-level checks (role-based access)\n  - [ ] No IDOR vulnerabilities (can't guess other users' resource IDs)\n  - [ ] Admin endpoints separately protected\n  - [ ] Webhook endpoints verify signatures\n\ninput_validation:\n  - [ ] All inputs validated server-side (never trust client)\n  - [ ] SQL injection prevented (parameterized queries only)\n  - [ ] NoSQL injection prevented\n  - [ ] Path traversal prevented\n  - [ ] Request size limited (body, headers, URL length)\n  - [ ] File upload types restricted and scanned\n\noutput_security:\n  - [ ] No sensitive data in responses (passwords, tokens, internal IDs)\n  - [ ] No stack traces in production errors\n  - [ ] Consistent error format (no info leakage in different error types)\n  - [ ] PII redacted in logs\n\ntransport:\n  - [ ] HTTPS only (HTTP redirects to HTTPS)\n  - [ ] HSTS header set\n  - [ ] TLS 1.2+ required\n  - [ ] CORS configured restrictively (specific origins, not *)\n  \nheaders:\n  - [ ] X-Content-Type-Options: nosniff\n  - [ ] X-Frame-Options: DENY\n  - [ ] Content-Security-Policy set\n  - [ ] No Server version header\n  - [ ] Cache-Control: no-store for sensitive endpoints\n```\n\n### CORS Configuration\n\n```yaml\n# Restrictive (recommended)\ncors:\n  origins:\n    - https://app.example.com\n    - https://admin.example.com\n  methods: [GET, POST, PUT, PATCH, DELETE]\n  headers: [Authorization, Content-Type, X-Request-ID]\n  credentials: true\n  max_age: 3600\n\n# Common mistakes to avoid:\n# ❌ Access-Control-Allow-Origin: *  (with credentials)\n# ❌ Reflecting Origin header without validation\n# ❌ Allowing all methods/headers\n```\n\n---\n\n## Phase 6: Versioning & Deprecation\n\n### Versioning Strategy Decision\n\n| Strategy | Example | Pros | Cons | Use When |\n|----------|---------|------|------|----------|\n| **URL path** | `/v1/orders` | Explicit, easy routing | URL pollution | Public APIs, multiple major versions |\n| **Header** | `API-Version: 2024-01` | Clean URLs | Hidden, harder to test | Internal APIs |\n| **Query param** | `?version=2` | Easy to test | Pollutes params | Quick prototypes |\n| **Date-based** | `2024-01-15` | Clear timeline | Many versions | Stripe-style APIs |\n\n**Recommended**: URL path for major versions, header for minor variations.\n\n### Deprecation Playbook\n\n```\nTimeline:\n1. T+0: Announce deprecation (docs, changelog, email)\n2. T+0: Add Deprecation + Sunset headers to old endpoints\n3. T+30d: Log warnings for old endpoint usage\n4. T+60d: Email heavy users of old endpoint directly\n5. T+90d: Return 299 warning header\n6. T+180d: Shut down old endpoint (410 Gone)\n\nHeaders:\nDeprecation: true\nSunset: Sat, 01 Jun 2025 00:00:00 GMT\nLink: <https://api.example.com/v2/orders>; rel=\"successor-version\"\n```\n\n### Migration Guide Template\n\n```markdown\n# Migrating from v1 to v2\n\n## Breaking Changes\n1. `user.name` split into `user.first_name` + `user.last_name`\n2. Pagination changed from offset to cursor-based\n3. Error format updated (see new schema)\n\n## Step-by-Step Migration\n1. Update your client SDK to v2 (`npm install @example/sdk@2`)\n2. Update response parsing for split name fields\n3. Replace `?page=N` with `?after=cursor` pagination\n4. Update error handling for new error format\n\n## Compatibility Mode\nSet `X-Compat-Mode: v1` header to get v1-style responses from v2 endpoints.\nAvailable until 2025-06-01.\n```\n\n---\n\n## Phase 7: Monitoring & Observability\n\n### Key Metrics Dashboard\n\n```yaml\navailability:\n  - Uptime percentage (target: 99.9% = 8.7h downtime/year)\n  - Health check status (/health endpoint)\n  - Error rate (5xx / total requests)\n\nperformance:\n  - p50 latency (target: < 100ms)\n  - p95 latency (target: < 500ms)\n  - p99 latency (target: < 1000ms)\n  - Throughput (requests/second)\n  - Time to first byte (TTFB)\n\nbusiness:\n  - Requests per endpoint (usage patterns)\n  - Unique API consumers/day\n  - Error rate by endpoint\n  - Rate limit hits/day\n  - Authentication failures/day\n\ninfrastructure:\n  - Database query time (p95)\n  - Connection pool utilization\n  - Memory/CPU per instance\n  - Queue depth (async operations)\n```\n\n### Structured Logging\n\nEvery request should log:\n\n```json\n{\n  \"timestamp\": \"2024-01-15T10:30:00.000Z\",\n  \"level\": \"info\",\n  \"request_id\": \"req_abc123\",\n  \"method\": \"POST\",\n  \"path\": \"/api/v1/orders\",\n  \"status\": 201,\n  \"duration_ms\": 45,\n  \"user_id\": \"usr_xyz\",\n  \"ip\": \"203.0.113.1\",\n  \"user_agent\": \"MyApp/2.0\",\n  \"request_size\": 256,\n  \"response_size\": 1024\n}\n```\n\n### Health Check Endpoint\n\n```json\n// GET /health — for load balancers (simple)\n{ \"status\": \"ok\" }\n\n// GET /health/detailed — for monitoring (authenticated)\n{\n  \"status\": \"degraded\",\n  \"version\": \"1.5.2\",\n  \"uptime_seconds\": 86400,\n  \"checks\": {\n    \"database\": { \"status\": \"ok\", \"latency_ms\": 5 },\n    \"redis\": { \"status\": \"ok\", \"latency_ms\": 2 },\n    \"external_payment_api\": { \"status\": \"degraded\", \"latency_ms\": 2500, \"error\": \"timeout\" },\n    \"disk\": { \"status\": \"ok\", \"free_gb\": 45.2 }\n  }\n}\n```\n\n---\n\n## Phase 8: API Review Scoring\n\nWhen reviewing an existing API, score across these dimensions:\n\n### API Quality Rubric (0-100)\n\n| Dimension | Weight | Criteria | Score |\n|-----------|--------|----------|-------|\n| **Design Consistency** | 20% | Naming conventions, HTTP methods, status codes, URL structure | /20 |\n| **Documentation** | 15% | OpenAPI spec, examples, error docs, changelog | /15 |\n| **Error Handling** | 15% | Consistent format, helpful messages, proper codes, no leakage | /15 |\n| **Security** | 20% | Auth, input validation, CORS, headers, no IDOR | /20 |\n| **Performance** | 15% | Latency targets met, pagination, caching headers, N+1 prevented | /15 |\n| **Developer Experience** | 15% | SDK quality, sandbox available, onboarding time, rate limit clarity | /15 |\n\n**Score: ___/100**\n\n| Rating | Score | Action |\n|--------|-------|--------|\n| 🟢 Excellent | 85-100 | Minor improvements only |\n| 🟡 Good | 70-84 | Address gaps before next major release |\n| 🟠 Needs Work | 50-69 | Prioritize improvements, create tech debt tickets |\n| 🔴 Critical | <50 | Stop feature work, fix fundamentals first |\n\n### Review Output Template\n\n```markdown\n## API Review: [Service Name]\n\n**Date:** YYYY-MM-DD\n**Reviewer:** [Agent]\n**Score:** XX/100 (Rating)\n\n### Summary\n[2-3 sentence overview of API quality]\n\n### Scores by Dimension\n- Design Consistency: X/20 — [key finding]\n- Documentation: X/15 — [key finding]\n- Error Handling: X/15 — [key finding]\n- Security: X/20 — [key finding]\n- Performance: X/15 — [key finding]\n- Developer Experience: X/15 — [key finding]\n\n### Critical Issues (fix immediately)\n1. [Issue + recommendation]\n\n### High Priority (fix this sprint)\n1. [Issue + recommendation]\n\n### Nice to Have (backlog)\n1. [Issue + recommendation]\n\n### Positive Highlights\n- [What's working well]\n```\n\n---\n\n## GraphQL-Specific Guidance\n\n### Schema Design Principles\n\n```graphql\n# Good: clear types, nullable where appropriate, connections for lists\ntype Order {\n  id: ID!\n  status: OrderStatus!\n  customer: Customer!\n  items(first: Int, after: String): ItemConnection!\n  total: Money!\n  createdAt: DateTime!\n  updatedAt: DateTime!\n}\n\ntype Money {\n  amount: Int!       # cents, not dollars (avoid float)\n  currency: Currency!\n}\n\nenum OrderStatus {\n  DRAFT\n  CONFIRMED\n  PROCESSING\n  SHIPPED\n  DELIVERED\n  CANCELLED\n}\n\n# Mutations return the modified resource + errors\ntype CreateOrderPayload {\n  order: Order\n  errors: [UserError!]!\n}\n\ntype UserError {\n  field: [String!]\n  message: String!\n  code: ErrorCode!\n}\n```\n\n### GraphQL Anti-Patterns\n\n| Anti-Pattern | Problem | Fix |\n|-------------|---------|-----|\n| No depth limit | Query bombs | Limit depth to 5-7 levels |\n| No complexity limit | Expensive queries | Assign cost per field, cap at 1000 |\n| N+1 queries | Performance death | Use DataLoader pattern |\n| No persisted queries | Security risk | Whitelist queries in production |\n| Exposing internal IDs | Leaks implementation | Use opaque global IDs |\n| No pagination | Memory explosion | Use Relay Connection spec |\n\n---\n\n## Edge Cases & Gotchas\n\n### Timezone Handling\n- Always store and return UTC (ISO 8601: `2024-01-15T10:30:00Z`)\n- Accept timezone in input, convert to UTC immediately\n- Never use local server time\n\n### Large Payloads\n- Set `Content-Length` limits (e.g., 1MB default, 10MB for uploads)\n- Use streaming for file uploads (multipart/form-data)\n- Compress responses (Accept-Encoding: gzip)\n- For very large exports → return 202 + poll status endpoint\n\n### Eventual Consistency\n- If using async processing, always return 202 + status URL\n- Include estimated completion time when possible\n- Client should poll with exponential backoff\n\n### Concurrent Updates\n- Use ETags for optimistic concurrency:\n  - GET returns `ETag: \"v1\"` header\n  - PUT/PATCH sends `If-Match: \"v1\"` header\n  - Server returns 412 if resource changed since\n\n### Webhook Design\n- Include event type, timestamp, and full resource in payload\n- Sign payloads (HMAC-SHA256)\n- Expect retries (make handlers idempotent)\n- Return 200 quickly, process async\n- Include webhook ID for deduplication\n\n---\n\n## Quick Commands\n\n| Request | Action |\n|---------|--------|\n| \"Design an API for [domain]\" | Run Phase 1 resource modeling + naming |\n| \"Generate OpenAPI spec\" | Run Phase 2 with full components |\n| \"Review this API\" | Run Phase 8 scoring rubric |\n| \"Write tests for [endpoint]\" | Run Phase 4 endpoint checklist |\n| \"Security audit this API\" | Run Phase 5 security checklist |\n| \"How should I version this?\" | Run Phase 6 decision matrix |\n| \"Debug this API issue\" | Check Phase 7 logging + health patterns |\n| \"Design GraphQL schema for [domain]\" | Run GraphQL section |\n","readmeExcerpt":"--- name: afrexai-api-architect description: Design, build, test, document, and secure production-grade APIs. Covers the full lifecycle from schema design through deployment, monitoring, and versioning. Use when designing new APIs, reviewing existing ones, generating OpenAPI specs, building test suites, or debugging production issues. metadata: {\"openclaw\":{\"os\":[\"linux\",\"darwin\",\"win32\"]}} --- API Architect — Full L","codeSnippets":[],"executableExamples":[{"language":"yaml","snippet":"# api-design.yaml\nservice: order-management\nbase_path: /api/v1\nresources:\n  - name: orders\n    path: /orders\n    description: Customer purchase orders\n    identifier: order_id (UUID)\n    parent: null\n    operations: [list, create, get, update, cancel]\n    sub_resources:\n      - name: line_items\n        path: /orders/{order_id}/items\n        operations: [list, add, update, remove]\n      - name: payments\n        path: /orders/{order_id}/payments\n        operations: [list, create, get, refund]\n    states: [draft, confirmed, processing, shipped, delivered, cancelled]\n    transitions:\n      - from: draft → to: confirmed (action: confirm)\n      - from: confirmed → to: processing (action: process)\n      - from: processing → to: shipped (action: ship)\n      - from: shipped → to: delivered (action: deliver)\n      - from: [draft, confirmed] → to: cancelled (action: cancel)"},{"language":"text","snippet":"Need to...                          → Method   Idempotent?  Safe?\nGet a resource or collection        → GET      Yes          Yes\nCreate a new resource               → POST     No           No\nFull replace of a resource          → PUT      Yes          No\nPartial update of a resource        → PATCH    No*          No\nRemove a resource                   → DELETE   Yes          No\nCheck if resource exists            → HEAD     Yes          Yes\nList allowed methods                → OPTIONS  Yes          Yes\n\n* PATCH can be idempotent if using JSON Merge Patch"},{"language":"text","snippet":"Success?\n├── Created something new? → 201 Created (Location header)\n├── Accepted for async processing? → 202 Accepted (include status URL)\n├── No body to return? → 204 No Content\n└── Returning data? → 200 OK\n\nClient error?\n├── Malformed request syntax? → 400 Bad Request\n├── No/invalid credentials? → 401 Unauthorized\n├── Valid credentials but insufficient permissions? → 403 Forbidden\n├── Resource doesn't exist? → 404 Not Found\n├── Method not allowed on resource? → 405 Method Not Allowed\n├── Conflict with current state? → 409 Conflict\n├── Resource permanently gone? → 410 Gone\n├── Validation failed? → 422 Unprocessable Entity\n├── Too many requests? → 429 Too Many Requests (Retry-After header)\n└── Precondition failed (etag mismatch)? → 412 Precondition Failed\n\nServer error?\n├── Unexpected failure? → 500 Internal Server Error\n├── Upstream dependency failed? → 502 Bad Gateway\n├── Temporarily overloaded? → 503 Service Unavailable (Retry-After)\n└── Upstream timeout? → 504 Gateway Timeout"},{"language":"json","snippet":"// Success (single resource)\n{\n  \"data\": { \"id\": \"ord_abc123\", \"status\": \"confirmed\", ... },\n  \"meta\": { \"request_id\": \"req_xyz789\" }\n}\n\n// Success (collection)\n{\n  \"data\": [ ... ],\n  \"meta\": { \"request_id\": \"req_xyz789\" },\n  \"pagination\": {\n    \"total\": 142,\n    \"page\": 2,\n    \"per_page\": 20,\n    \"total_pages\": 8,\n    \"next\": \"/api/v1/orders?page=3&per_page=20\",\n    \"prev\": \"/api/v1/orders?page=1&per_page=20\"\n  }\n}\n\n// Error\n{\n  \"error\": {\n    \"code\": \"VALIDATION_FAILED\",\n    \"message\": \"Request validation failed\",\n    \"details\": [\n      { \"field\": \"email\", \"message\": \"Must be a valid email address\", \"code\": \"INVALID_FORMAT\" },\n      { \"field\": \"age\", \"message\": \"Must be at least 18\", \"code\": \"MIN_VALUE\", \"min\": 18 }\n    ]\n  },\n  \"meta\": { \"request_id\": \"req_xyz789\" }\n}"},{"language":"text","snippet":"# Filtering\nGET /orders?status=active&created_after=2024-01-01&total_min=100\n\n# Sorting (prefix - for descending)\nGET /orders?sort=-created_at,total\n\n# Field selection (reduce payload)\nGET /orders?fields=id,status,total,customer.name\n\n# Search\nGET /products?q=wireless+headphones\n\n# Combined\nGET /orders?status=active&sort=-created_at&fields=id,status,total&page=1&per_page=10"},{"language":"yaml","snippet":"openapi: 3.1.0\ninfo:\n  title: Order Management API\n  version: 1.0.0\n  description: |\n    Order lifecycle management.\n    \n    ## Authentication\n    All endpoints require Bearer token authentication.\n    \n    ## Rate Limits\n    - Standard: 100 req/min\n    - Bulk operations: 10 req/min\n  contact:\n    name: API Support\n    email: api@example.com\n  license:\n    name: MIT\nservers:\n  - url: https://api.example.com/v1\n    description: Production\n  - url: https://staging-api.example.com/v1\n    description: Staging\n\npaths:\n  /orders:\n    get:\n      operationId: listOrders\n      summary: List orders\n      tags: [Orders]\n      parameters:\n        - $ref: '#/components/parameters/PageParam'\n        - $ref: '#/components/parameters/PerPageParam'\n        - name: status\n          in: query\n          schema:\n            $ref: '#/components/schemas/OrderStatus'\n        - name: created_after\n          in: query\n          schema:\n            type: string\n            format: date-time\n      responses:\n        '200':\n          description: Order list\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/OrderListResponse'\n        '401':\n          $ref: '#/components/responses/Unauthorized'\n\n    post:\n      operationId: createOrder\n      summary: Create an order\n      tags: [Orders]\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/CreateOrderRequest'\n            examples:\n              basic:\n                summary: Basic order\n                value:\n                  customer_id: \"cust_abc\"\n                  items:\n                    - product_id: \"prod_xyz\"\n                      quantity: 2\n      responses:\n        '201':\n          description: Order created\n          headers:\n            Location:\n              schema:\n                type: string\n              description: URL of created order\n          content:\n           "}],"parameters":{},"dependencies":[],"permissions":[],"extractedFiles":[],"languages":["typescript"],"docsSourceLabel":"CLAWHUB","editorialOverview":"Design, build, test, document, and secure production-grade APIs. Covers the full lifecycle from schema design through deployment, monitoring, and versioning. Use when designing new APIs, reviewing existing ones, generating OpenAPI specs, building test suites, or debugging production issues. --- name: afrexai-api-architect description: Design, build, test, document, and secure production-grade APIs. Covers the full lifecycle from schema design through deployment, monitoring, and versioning. Use when designing new APIs, reviewing existing ones, generating OpenAPI specs, building test suites, or debugging production issues. metadata: {\"openclaw\":{\"os\":[\"linux\",\"darwin\",\"win32\"]}} --- API Architect — Full L","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":406,"uniquenessScore":61,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-09T15:06:37.850Z","emptyReason":null},"items":[{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-10T18:48:31.762Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}