Comprehensive guidelines for Django REST API development covering project structure, views, models, serializers, authentication, performance, and error handling.
Install
npx skills add https://github.com/mindrally/skills --skill rest-api-djangoSKILL.md
REST API Development with Django
You are an expert in Django REST Framework for building scalable APIs.
Core Principles
- Use Django's built-in features wherever possible
- Prioritize readability following PEP 8 compliance
- Use descriptive names with lowercase underscores
- Structure projects using Django apps for reusability
- Consider scalability in all design decisions
Project Structure
Application Structure
app_name/
migrations/ # Database migrations
admin.py # Admin configuration
models.py # Data models
managers.py # Custom model managers
signals.py # Django signals
tasks.py # Celery tasks
API Structure
api/
v1/
urls.py # URL routing
serializers.py # DRF serializers
views.py # API views
permissions.py # Custom permissions
filters.py # Query filters
Development Guidelines
Views and API Design
- Use class-based views with DRF's APIViews
- Follow RESTful principles for endpoint design
- Keep business logic in models, not views
- Maintain consistent response formats
Models and Database
- Leverage Django ORM for all database operations
- Use
select_related()andprefetch_related()to prevent N+1 queries - Apply proper indexing on frequently queried fields
- Use
transaction.atomic()for critical operations
Serializers and Validation
- Use DRF serializers for all data transformation
- Implement custom validators for complex validation
- Handle nested relationships properly
- Keep serializers focused and composable
Authentication and Authorization
- Use
djangorestframework_simplejwtfor JWT authentication - Implement granular permissions per endpoint
- Ensure CSRF protection for session-based auth
- Apply principle of least privilege
Performance Optimization
- Prevent N+1 queries through eager loading
- Implement database connection pooling
- Use Redis or Memcached for caching
- Apply standardized pagination to list endpoints
Error Handling
{
"success": False,
"message": "Validation failed",
"errors": {
"field_name": ["Error message"]
},
"error_code": "VALIDATION_ERROR"
}
- Use appropriate HTTP status codes
- Return consistent error response structure
- Apply structured logging for debugging
- Never expose internal errors to clients
Related skills
entra-app-registrationmicrosoft606KGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.azure-messagingmicrosoft595KTroubleshoot and resolve issues with Azure Messaging SDKs for Event Hubs and Service Bus. Covers connection failures, authentication errors, message processing issues, and SDK configuration problems. WHEN: event hub SDK error, service bus SDK issue, messaging connection failure, AMQP error, event processor host issue, message lock lost, message lock expired, lock renewal, lock renewal batch, send timeout, receiver disconnected, SDK troubleshooting, azure messaging SDK, event hub consumer, servicentra-agent-idmicrosoft328KProvision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registsupabasesupabase298KUse when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, declarative schemas, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector); deb