As of 13 August 2026, AI can only partly build an API for your business software.

What to actually do

1. Hand it to a person

   The route this page recommends

   A person who owns the outcome does this end to end, worth it when the failure is dear.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 2 hours until you can act on the result.

   How to actually do it

   1. Open a requirements document and write the API's purpose, users, operations, data fields, business rules, expected traffic and hosting environment.
   2. Gather the current database schema, existing software documentation, sample requests and responses, authentication details and a list of fields containing personal or commercially sensitive data; remove all real credentials and customer records.
   3. Paste the gathered specification into the prompt, choose the required language and framework, and ask the chatbot to produce the endpoint design and OpenAPI specification before asking for implementation code.
   4. Create a separate development project and paste in the generated files, keeping secrets in environment variables and recording every assumption the model marked as unknown.
   5. Run the generated project locally, use the OpenAPI examples or an API client to test successful requests, invalid inputs, unauthorised requests, missing records, duplicate requests and service failures.
   6. Compare each endpoint and validation rule against the business requirements and database schema, then ask a developer or technically capable colleague to inspect access control, sensitive-data handling, dependency versions, logging, rate limits and deployment settings.
   7. Deploy only to a non-production environment, connect it to test data, run the agreed integration tests and confirm rollback and monitoring before requesting approval for production.

   Prompt

   Act as a senior backend developer helping me design an API, not as the final approver. Build a small, maintainable API specification and implementation plan for this business software.
   
   Business purpose: [describe what the software does]
   Users and systems that will call the API: [describe them]
   Operations required: [list each operation, such as create, read, update or delete]
   Data entities and fields: [list them, including which fields are sensitive]
   Business rules: [list validations, permissions and workflow rules]
   Existing software and database: [describe the stack, versions and available interfaces]
   Authentication and authorisation requirements: [describe them, or state that they are unknown]
   Expected traffic and availability needs: [describe them, or state that they are unknown]
   Hosting and deployment environment: [describe it, or state that it is unknown]
   UK requirements: account for UK GDPR and data minimisation where personal data is involved, but do not claim legal compliance without identifying what must be reviewed.
   
   First, state the assumptions and list the information that is missing. Then provide:
   1. An endpoint list with methods, paths, parameters, request examples and response examples.
   2. A data model and validation rules.
   3. An authentication, authorisation, secrets-management and audit-log design.
   4. An OpenAPI specification.
   5. A proposed project structure and implementation in [language and framework].
   6. Unit, integration, security and failure-case tests.
   7. A local setup, test and deployment procedure.
   8. A review checklist covering access control, injection, sensitive data, rate limits, logging, backups, rollback and monitoring.
   
   Do not invent undocumented fields, credentials, integrations or compliance claims. Mark every assumption clearly. Keep production secrets out of the code. If a requirement is ambiguous or unsafe, stop and ask a focused question instead of choosing silently. Explain which parts require review by a qualified developer before deployment.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.