Engineering guides

Engineering guides

API design checklist

Write the contract first (RAML or OpenAPI). Use nouns for resources and standard HTTP methods. Version in the path or header from day one. Return consistent error bodies with a correlation ID. Document every field, including which are sensitive.

CI/CD pipeline stages

Build, then unit tests, static analysis, and dependency scanning; deploy to a test environment and run integration tests; promote the same artifact to each higher environment; require approval for production; keep every step logged.

C4E starter kit

Publish naming and security standards, project templates, and a reusable asset catalog. Hold short design reviews for new APIs. Measure reuse, and retire duplicate APIs.

MCP server hardening

Authenticate every client. Authorize each tool against the calling user's rights. Keep tools narrow and read-only by default. Mask sensitive fields. Log every call with user, tool, and parameters, and forward logs to your SIEM.

Secrets and configuration

Never commit credentials. Use a secrets manager or the platform's secure properties, rotate keys, and keep environment configuration outside the code.

Operational readiness

Before go-live: dashboards and alerts in place, runbooks written, log retention agreed, and an owner named for every API.