REST API conventions tests expect

Build labs and debugging rounds check conventions, not just data. These are the defaults most tests assume.

Routes

Errors have one shape

{ "error": "title is required" }

Pick a shape and use it everywhere. Tests often assert res.body.error exists or matches a message.

Pagination

{ "items": [...], "page": 2, "limit": 20, "total": 57, "totalPages": 3 }

• page starts at 1; skip = (page - 1) * limit.
• totalPages = Math.ceil(total / limit); with total = 0 that's 0, not 1.
• Sort before paginating, with a tiebreaker (createdAt, then _id), or items repeat or vanish between pages.
• Clamp limit so ?limit=1000000 can't dump the table.

Idempotency

GET, PUT and DELETE should be safe to retry: deleting twice gives 404 (or 204) the second time, not a crash. POST isn't idempotent; use an idempotency key when retries matter (payments).

Don't leak

Strip internal fields (password, __v, internal flags) from every response, including create and update, not only reads.