GitHub Copilot Prompt for Creating a REST API
GitHub Copilot has become an essential assistant for developers looking to accelerate the creation of REST APIs. Thanks to its direct integration into the code editor, it understands the context of your project and generates structured code in real time. Whether you work with Node.js and Express, Python and FastAPI, or Java and Spring Boot, Copilot adapts to your tech stack to produce endpoints conforming to REST conventions. The main challenge lies in formulating the prompt: a well-structured prompt yields a complete API with data validation, error handling, authentication, and documentation. A vague prompt, on the other hand, will produce generic code requiring many adjustments. In this guide, we offer an optimized prompt that fully leverages GitHub Copilot's capabilities to generate a professional, testable, production-ready REST API. You will also discover variants adapted to your experience level as well as practical tips to get the most out of this tool on a daily basis.
Paste in your AI
Paste this prompt in ChatGPT, Claude or Gemini and customize the variables in brackets.
Create a complete REST API to manage a 'products' resource with the following specifications:
- Tech stack: Node.js with Express and TypeScript
- Database: PostgreSQL with Prisma as ORM
- Full CRUD endpoints:
- GET /api/products (paginated list with filters by category and price)
- GET /api/products/:id (product details)
- POST /api/products (creation with Zod validation)
- PUT /api/products/:id (full update)
- PATCH /api/products/:id (partial update)
- DELETE /api/products/:id (soft delete)
- Include: input validation, centralized error handling with appropriate HTTP codes, pagination with metadata (total, page, limit), JWT authentication middleware
- Structure: separate routes, controllers, services, and validation schemas
- Add TypeScript types for each entity and API response
Personalize this prompt with Léa
Answer 3 questions and Léa tailors the prompt to your situation.
Why this prompt works
This prompt is effective because it explicitly specifies the tech stack, eliminating any ambiguity about the technologies to use. The numbered list of endpoints with their expected behaviors guides Copilot toward an implementation that meets REST standards. Finally, the request for separation into layers (routes, controllers, services) forces the generation of a modular architecture rather than a monolithic file.
Use Cases
Variants
Expected Output
Copilot generates a structured REST API with separate files for each application layer: typed Express routes, controllers with HTTP response management, services containing business logic, and Zod schemas for validation. The code includes pagination, filtering, centralized error handling, and a functional JWT middleware, all in strict TypeScript.
Frequently Asked Questions
How does GitHub Copilot handle my existing project context when generating a REST API?
GitHub Copilot analyzes open files in your editor, imports, dependencies from your package.json, and existing code in the project. If you already have a defined Prisma model or existing routes, Copilot adapts to those conventions. For best results, open configuration files (tsconfig.json, prisma/schema.prisma) and an example route before triggering your prompt. Copilot will use these elements as a reference to maintain consistency in the generated code.
Should I write the prompt in a comment or use Copilot Chat to create the API?
Both approaches are complementary. Use Copilot Chat (Ctrl+I or Cmd+I) to generate the initial full API structure with the main prompt: this creates multiple files at once. Then, use inline comments to refine each endpoint individually, for example by writing '// Add a price range filter with min < max validation' above a route. Copilot Chat excels at multi-file code generation, while comments are more effective for targeted adjustments.
How can I ensure the code generated by Copilot follows REST API security best practices?
The prompt should explicitly mention the desired security aspects: input validation, authentication, rate limiting, data sanitization. Copilot does not systematically add these on its own. After generation, specifically check for SQL injection protection (use a parameterized ORM), validation of incoming data types and formats, presence of security headers (helmet), masking internal errors in production, and request rate limiting. Always follow up with a manual code review and security testing using tools like OWASP ZAP.
Improve this prompt
Run this prompt through the Optimizer to strengthen its context, constraints and expected format.
Improve this prompt with the OptimizerComments
Be the first to comment on this prompt.
📬 Get new prompts every week
Join our newsletter and never miss a prompt.