api-compliance

Name: api-compliance
Author: LambdaTest

335stars67forks

How to install api-compliance?

lambdatest/agent-skills/api-compliance

$npx -y skills add LambdaTest/agent-skills --skill api-compliance

Installs into the current project.

Summary

Designs GDPR-compliant API patterns, PCI-DSS field handling, SOC2 audit log schemas, HIPAA data endpoints, and regulatory compliance checklists for any API. Use whenever the user asks about GDPR, data privacy, "right to be forgotten", data retention APIs, PCI compliance for payme

Files · 1

View on GitHub

SKILL.md

1	# API Compliance & Audit Skill
2
3	Design compliant API patterns for GDPR, PCI-DSS, HIPAA, SOC2, and other regulatory frameworks.
4
5	---
6
7	## GDPR Data Subject Rights Endpoints
8
9	```
10	POST /api/v1/privacy/data-export-request — user requests copy of their data (Art. 20)
11	GET /api/v1/privacy/data-export/{token} — download export (after processing)
12	POST /api/v1/privacy/deletion-request — right to erasure (Art. 17)
13	GET /api/v1/privacy/deletion-status/{id} — track deletion progress
14	POST /api/v1/privacy/rectification — correct inaccurate personal data (Art. 16)
15	GET /api/v1/privacy/consent — get user's consent records
16	POST /api/v1/privacy/consent — record/update consent
17	DELETE /api/v1/privacy/consent/{purpose} — withdraw consent for a purpose
18	POST /api/v1/privacy/portability — export data in machine-readable format
19	```
20
21	### Data Export Response
22	```json
23	{
24	"request_id": "uuid",
25	"status": "processing",
26	"estimated_completion": "2024-01-02T00:00:00Z",
27	"download_url": null,
28	"expires_at": null
29	}
30	```
31
32	### Consent Record
33	```json
34	{
35	"user_id": "uuid",
36	"consents": [
37	{
38	"purpose": "marketing_email",
39	"granted": true,
40	"granted_at": "2023-06-01T00:00:00Z",
41	"ip_address": "1.2.3.x",
42	"method": "explicit_checkbox"
43	},
44	{
45	"purpose": "analytics",
46	"granted": false,
47	"withdrawn_at": "2023-12-01T00:00:00Z"
48	}
49	]
50	}
51	```
52
53	---
54
55	## PCI-DSS Field Masking Rules
56
57	\| Field \| Storage \| API Response \| Logs \|
58	\|-------\|---------\|-------------\|------\|
59	\| Card number (PAN) \| Tokenised only \| `** ** 4242` \| Never log \|
60	\| CVV/CVC \| Never store \| Never return \| Never log \|
61	\| Expiry date \| Encrypted \| `MM/YY` only \| Never log \|
62	\| Cardholder name \| Encrypted \| Masked `A* S*` \| Never log \|
63	\| Bank account number \| Tokenised \| Last 4 digits only \| Never log \|
64
65	```json
66	{
67	"payment_method": {
68	"type": "card",
69	"last4": "4242",
70	"brand": "visa",
71	"exp_month": 12,
72	"exp_year": 2027,
73	"token": "tok_abc123"
74	}
75	}
76	```
77
78	---
79
80	## HIPAA — Health Data Endpoints
81
82	PHI (Protected Health Information) rules:
83	- Minimum necessary data principle: return only fields required for the stated purpose
84	- All endpoints carrying PHI must require MFA-backed auth
85	- Audit log every access to PHI — who accessed what, when
86
87	```
88	GET /api/v1/patients/{id}/records — requires: HIPAA BAA, audit logged
89	GET /api/v1/patients/{id}/medications — minimum necessary: only active prescriptions
90	POST /api/v1/access-log/query — compliance officer audit log query
91	```
92
93	PHI fields requiring special handling: `name`, `dob`, `ssn`, `address`, `phone`, `email`, `mrn`, `diagnosis`, `treatment`.
94
95	---
96
97	## SOC2 Audit Log Schema
98
99	Every state-changing action must produce an immutable audit log entry:
100
101	```json
102	{
103	"id": "evt_uuid",
104	"timestamp": "ISO8601",
105	"actor": {
106	"type": "user\|service\|system",
107	"id": "uuid",
108	"ip_address": "1.2.3.x",
109	"user_agent": "Mozilla/5.0..."
110	},
111	"action": "user.deleted",
112	"resource": {
113	"type": "user",
114	"id": "uuid"
115	},
116	"changes": {
117	"before": { "status": "active" },
118	"after": { "status": "deleted" }
119	},
120	"result": "success\|failure",
121	"request_id": "uuid",
122	"tenant_id": "uuid"
123	}
124	```
125
126	### Audit Log Query Endpoint
127	```
128	GET /api/v1/audit-logs
129	Query params: actor_id, resource_type, action, from, to, result
130	Response: paginated list of audit events
131	```
132
133	Audit log requirements:
134	- Immutable: no DELETE or UPDATE on audit records
135	- Retention: minimum 1 year online, 7 years archived (SOC2)
136	- Integrity: hash-chain or WORM storage to prevent tampering
137	- Export: CSV/JSON export for compliance officer review
138
139	---
140
141	## Data Retention Policy Endpoints
142
143	```
144	GET /api/v1/admin/retention-policies — list policies by data type
145	POST /api/v1/admin/retention-policies — define new policy
146	POST /api/v1/admin/retention/purge-dry-run — preview what would be deleted
147	POST /api/v1/admin/retention/purge — execute purge (requires 2-person auth)
148	GET /api/v1/admin/retention/purge/{id

People who liked this also viewed

6 picks

Type

api-compliance

335stars67forks

View on GitHub

How to install api-compliance?

lambdatest/agent-skills/api-compliance

$npx -y skills add LambdaTest/agent-skills --skill api-compliance

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# API Compliance & Audit Skill
2
3	Design compliant API patterns for GDPR, PCI-DSS, HIPAA, SOC2, and other regulatory frameworks.
4
5	---
6
7	## GDPR Data Subject Rights Endpoints
8
9	```
10	POST /api/v1/privacy/data-export-request — user requests copy of their data (Art. 20)
11	GET /api/v1/privacy/data-export/{token} — download export (after processing)
12	POST /api/v1/privacy/deletion-request — right to erasure (Art. 17)
13	GET /api/v1/privacy/deletion-status/{id} — track deletion progress
14	POST /api/v1/privacy/rectification — correct inaccurate personal data (Art. 16)
15	GET /api/v1/privacy/consent — get user's consent records
16	POST /api/v1/privacy/consent — record/update consent
17	DELETE /api/v1/privacy/consent/{purpose} — withdraw consent for a purpose
18	POST /api/v1/privacy/portability — export data in machine-readable format
19	```
20
21	### Data Export Response
22	```json
23	{
24	"request_id": "uuid",
25	"status": "processing",
26	"estimated_completion": "2024-01-02T00:00:00Z",
27	"download_url": null,
28	"expires_at": null
29	}
30	```
31
32	### Consent Record
33	```json
34	{
35	"user_id": "uuid",
36	"consents": [
37	{
38	"purpose": "marketing_email",
39	"granted": true,
40	"granted_at": "2023-06-01T00:00:00Z",
41	"ip_address": "1.2.3.x",
42	"method": "explicit_checkbox"
43	},
44	{
45	"purpose": "analytics",
46	"granted": false,
47	"withdrawn_at": "2023-12-01T00:00:00Z"
48	}
49	]
50	}
51	```
52
53	---
54
55	## PCI-DSS Field Masking Rules
56
57	\| Field \| Storage \| API Response \| Logs \|
58	\|-------\|---------\|-------------\|------\|
59	\| Card number (PAN) \| Tokenised only \| `** ** 4242` \| Never log \|
60	\| CVV/CVC \| Never store \| Never return \| Never log \|
61	\| Expiry date \| Encrypted \| `MM/YY` only \| Never log \|
62	\| Cardholder name \| Encrypted \| Masked `A* S*` \| Never log \|
63	\| Bank account number \| Tokenised \| Last 4 digits only \| Never log \|
64
65	```json
66	{
67	"payment_method": {
68	"type": "card",
69	"last4": "4242",
70	"brand": "visa",
71	"exp_month": 12,
72	"exp_year": 2027,
73	"token": "tok_abc123"
74	}
75	}
76	```
77
78	---
79
80	## HIPAA — Health Data Endpoints
81
82	PHI (Protected Health Information) rules:
83	- Minimum necessary data principle: return only fields required for the stated purpose
84	- All endpoints carrying PHI must require MFA-backed auth
85	- Audit log every access to PHI — who accessed what, when
86
87	```
88	GET /api/v1/patients/{id}/records — requires: HIPAA BAA, audit logged
89	GET /api/v1/patients/{id}/medications — minimum necessary: only active prescriptions
90	POST /api/v1/access-log/query — compliance officer audit log query
91	```
92
93	PHI fields requiring special handling: `name`, `dob`, `ssn`, `address`, `phone`, `email`, `mrn`, `diagnosis`, `treatment`.
94
95	---
96
97	## SOC2 Audit Log Schema
98
99	Every state-changing action must produce an immutable audit log entry:
100
101	```json
102	{
103	"id": "evt_uuid",
104	"timestamp": "ISO8601",
105	"actor": {
106	"type": "user\|service\|system",
107	"id": "uuid",
108	"ip_address": "1.2.3.x",
109	"user_agent": "Mozilla/5.0..."
110	},
111	"action": "user.deleted",
112	"resource": {
113	"type": "user",
114	"id": "uuid"
115	},
116	"changes": {
117	"before": { "status": "active" },
118	"after": { "status": "deleted" }
119	},
120	"result": "success\|failure",
121	"request_id": "uuid",
122	"tenant_id": "uuid"
123	}
124	```
125
126	### Audit Log Query Endpoint
127	```
128	GET /api/v1/audit-logs
129	Query params: actor_id, resource_type, action, from, to, result
130	Response: paginated list of audit events
131	```
132
133	Audit log requirements:
134	- Immutable: no DELETE or UPDATE on audit records
135	- Retention: minimum 1 year online, 7 years archived (SOC2)
136	- Integrity: hash-chain or WORM storage to prevent tampering
137	- Export: CSV/JSON export for compliance officer review
138
139	---
140
141	## Data Retention Policy Endpoints
142
143	```
144	GET /api/v1/admin/retention-policies — list policies by data type
145	POST /api/v1/admin/retention-policies — define new policy
146	POST /api/v1/admin/retention/purge-dry-run — preview what would be deleted
147	POST /api/v1/admin/retention/purge — execute purge (requires 2-person auth)
148	GET /api/v1/admin/retention/purge/{id

People who liked this also viewed

6 picks

Type