Django REST Framework patterns. Trigger: When implementing generic DRF APIs (ViewSets, serializers, routers, permissions, filtersets). For Prowler API specifics (RLS/RBAC/Providers), also use prowler-api.

Critical Patterns ALWAYS separate serializers by operation: Read / Create / Update / Include ALWAYS use filterset class for complex filtering (not filterset fields ) ALWAYS validate unknown fields in write serializers (inherit BaseWriteSerializer ) ALWAYS use select related / prefetch related in get queryset() to avoid N+1 ALWAYS handle swagger fake view in get queryset() for schema generation ALWAYS use @extend schema field for OpenAPI docs on SerializerMethodField NEVER put business logic in serializers use services/utils NEVER use auto increment PKs use UUIDv4 or UUIDv7 NEVER use trailing slashes in URLs ( trailing slash=False ) Note: swagger fake view is specific to drf spectacular for OpenAPI schema generation. Implementation Checklist When implementing a new endpoint, review these patterns in order: Pattern Reference Key Points 1 Models api/models.py UUID PK, inserted at / updated at , JSONAPIMeta.resource name 2 ViewSets api/base views.py , api/v1/views.py Inherit BaseRLSViewSet , get queryset() with N+1 prevention 3 Serializers api/v1/serializers.py Separate Read/Create/Update/Include, inherit BaseWriteSerializer 4 Filters api/filters.py Use filterset class , inherit base filter classes 5 Permissions api/base views.py required permissions , set required permissions() 6 Pagination api/pagination.py Custom pagination class if needed 7 URL Routing api/v1/urls.py trailing slash=False , kebab case paths 8 OpenAPI Schema api/v1/views.py @extend schema view with drf spectacular 9 Tests api/tests/test views.py JSON:API content type, fixture patterns Full file paths : See [references/file locations.md](references/file locations.md) Decision Trees Which Serializer? Which Base Serializer? Which Filter Base? Which Base ViewSet? Resource Name Format? Serializer Patterns Base Class Hierarchy SerializerMethodField with OpenAPI Included Serializers (JSON:API) Sensitive Data Masking ViewSet Patterns get queryset() with N+1 Prevention Always combine swagger fake view check with select related / prefetch related : Why swagger fake view? drf spectacular introspects ViewSets to generate OpenAPI schemas. Without this check, it executes real queries and can fail without request context. Action Specific Serializers Dynamic Permissions per Action Cache Decorator Custom Actions Filter Patterns Base Filter Classes Custom Multi Value Filters ArrayField Filtering Date Range Validation Dynamic FilterSet Selection Enum Field Override Performance Patterns PaginateByPkMixin For large querysets with expensive joins: Prefetch in Serializers Naming Conventions Entity Pattern Example Serializer (read) <Model Serializer ProviderSerializer Serializer (create) <Model CreateSerializer ProviderCreateSerializer Serializer (update) <Model UpdateSerializer ProviderUpdateSerializer Serializer (include) <Model IncludeSerializer ProviderIncludeSerializer Filter <Model Filter ProviderFilter ViewSet <Model ViewSet ProviderViewSet OpenAPI Documentation API Security Patterns Full examples : See [assets/security patterns.py](assets/security patterns.py) Pattern Key Points Input Validation Use validate <field () for sanitization, validate() for cross field Prevent Mass Assignment ALWAYS use explicit fields list, NEVER all or exclude Object Level Permissions Implement has object permission() for ownership checks Rate Limiting Configure DEFAULT THROTTLE RATES , use per view throttles for sensitive endpoints Prevent Info Disclosure Generic error messages, return 404 not 403 for unauthorized (prevents enumeration) SQL Injection ALWAYS use ORM parameterization, NEVER string interpolation in raw SQL Quick Reference Commands Resources Local References File Locations : See [references/file locations.md](references/file locations.md) JSON:API Conventions : See [references/json api conventions.md](references/json api conventions.md) Security Patterns : See [assets/security patterns.py](assets/security patterns.py) Context7 MCP (Recommended) Prerequisite: Install Context7 MCP server for up to date documentation lookup. When implementing or debugging, query these libraries via mcp context7 query docs : Library Context7 ID Use For Django /websites/djangoproject en 5 2 Models, ORM, migrations DRF /websites/django rest framework ViewSets, serializers, permissions drf spectacular /tfranzel/drf spectacular OpenAPI schema, @extend schema Example queries: Note: Use mcp context7 resolve library id first if you need to find the correct library ID. External Docs DRF Docs : https://www.django rest framework.org/ DRF JSON:API : https://django rest framework json api.readthedocs.io/ drf spectacular : https://drf spectacular.readthedocs.io/ django filter : https://django filter.readthedocs.io/

django-drf