# ASP.NET Core Web API

> Modern ASP.NET Core patterns for building RESTful APIs.

- **Type:** Skill
- **Install:** `agentstack add skill-ngxtm-devkit-aspnet-core`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ngxtm](https://agentstack.voostack.com/s/ngxtm)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [ngxtm](https://github.com/ngxtm)
- **Source:** https://github.com/ngxtm/devkit/tree/main/rules/dotnet/aspnet-core

## Install

```sh
agentstack add skill-ngxtm-devkit-aspnet-core
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# ASP.NET Core Web API

## **Priority: P1 (OPERATIONAL)**

Modern ASP.NET Core patterns for building RESTful APIs.

## Implementation Guidelines

- **Minimal APIs**: Use for simple endpoints. `app.MapGet()`, route groups, endpoint filters.
- **Controllers**: Use `[ApiController]` for automatic model validation and binding.
- **Middleware**: Order matters. Custom middleware with `app.Use()`.
- **Filters**: Action filters for cross-cutting concerns. Exception filters for error handling.
- **Validation**: FluentValidation or DataAnnotations. Return `ProblemDetails` on errors.
- **Versioning**: URL-based (`/api/v1/`) or header-based versioning.
- **OpenAPI**: Always configure Swagger for API documentation.
- **Response Types**: Use `TypedResults` for compile-time safety.

## Anti-Patterns

- **No `HttpClient` without `IHttpClientFactory`**: Socket exhaustion risk.
- **No blocking async**: Never `.Result` or `.Wait()` in controllers.
- **No business logic in controllers**: Controllers should only orchestrate.
- **No returning `Task` without `async`**: Use `async` keyword or return directly.

## Code

```csharp
// Minimal API with route groups
var app = WebApplication.CreateBuilder(args).Build();

var users = app.MapGroup("/api/users")
    .WithTags("Users")
    .RequireAuthorization();

users.MapGet("/", async (IUserService service) =>
    TypedResults.Ok(await service.GetAllAsync()));

users.MapGet("/{id:int}", async (int id, IUserService service) =>
    await service.GetByIdAsync(id) is { } user
        ? TypedResults.Ok(user)
        : TypedResults.NotFound());

users.MapPost("/", async (CreateUserDto dto, IUserService service) =>
{
    var user = await service.CreateAsync(dto);
    return TypedResults.Created($"/api/users/{user.Id}", user);
}).AddEndpointFilter>();

// Controller with proper patterns
[ApiController]
[Route("api/[controller]")]
[Produces("application/json")]
public class OrdersController(IOrderService orderService) : ControllerBase
{
    [HttpGet("{id:int}")]
    [ProducesResponseType(StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    public async Task GetOrder(int id, CancellationToken ct)
    {
        var order = await orderService.GetByIdAsync(id, ct);
        return order is null ? NotFound() : Ok(order);
    }

    [HttpPost]
    [ProducesResponseType(StatusCodes.Status201Created)]
    [ProducesResponseType(StatusCodes.Status400BadRequest)]
    public async Task CreateOrder(CreateOrderDto dto, CancellationToken ct)
    {
        var order = await orderService.CreateAsync(dto, ct);
        return CreatedAtAction(nameof(GetOrder), new { id = order.Id }, order);
    }
}
```

## Reference & Examples

For middleware, exception handling, and HttpClientFactory:
See [references/REFERENCE.md](references/REFERENCE.md).

## Related Topics

security | razor-pages | blazor

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ngxtm](https://github.com/ngxtm)
- **Source:** [ngxtm/devkit](https://github.com/ngxtm/devkit)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-ngxtm-devkit-aspnet-core
- Seller: https://agentstack.voostack.com/s/ngxtm
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.