FastAPI Core Knowledge

Full Reference: See advanced.md for WebSocket integration including connection management, authentication, room management, Pydantic message protocols, heartbeat, Redis pub/sub scaling, and background tasks.

Deep Knowledge: Use mcp__documentation__fetch_docs with technology: fastapi for comprehensive documentation.

Basic Setup

from fastapi import FastAPI, HTTPException, Depends
from pydantic import BaseModel, EmailStr

app = FastAPI(title="My API")

class UserCreate(BaseModel):
    name: str
    email: EmailStr

class User(UserCreate):
    id: int

    class Config:
        from_attributes = True

Route Patterns

@app.get("/users", response_model=list[User])
async def get_users(skip: int = 0, limit: int = 100):
    return await db.users.find_many(skip=skip, limit=limit)

@app.get("/users/{user_id}", response_model=User)
async def get_user(user_id: int):
    user = await db.users.find(user_id)
    if not user:
        raise HTTPException(status_code=404, detail="User not found")
    return user

@app.post("/users", response_model=User, status_code=201)
async def create_user(user: UserCreate):
    return await db.users.create(user.model_dump())

Dependency Injection

async def get_db():
    db = SessionLocal()
    try:
        yield db
    finally:
        db.close()

async def get_current_user(token: str = Depends(oauth2_scheme)):
    user = await verify_token(token)
    if not user:
        raise HTTPException(status_code=401, detail="Invalid token")
    return user

@app.get("/me", response_model=User)
async def get_me(user: User = Depends(get_current_user)):
    return user

Key Features

• Auto OpenAPI/Swagger docs at /docs
• Pydantic validation
• Async support
• Type hints everywhere

When NOT to Use This Skill

• Django projects - Django has its own ORM, admin, templates
• Flask microservices - Flask is lighter without type validation overhead
• Synchronous WSGI apps - FastAPI is async-first
• Legacy Python 2.x - FastAPI requires Python 3.7+
• Non-REST APIs - Use dedicated GraphQL or gRPC frameworks

Anti-Patterns

Anti-Pattern	Why It's Bad	Solution
def instead of async def	Blocks event loop	Use async def for I/O operations
Missing response_model	No output validation	Always specify response_model
Sync database calls	Blocks workers	Use async drivers (asyncpg, motor)
Global state without locks	Race conditions	Use asyncio.Lock or Depends()
Raising exceptions without HTTPException	Generic 500 errors	Use HTTPException with status codes
No input validation	Security vulnerabilities	Use Pydantic models with validators

Quick Troubleshooting

Problem	Diagnosis	Fix
"RuntimeError: no running event loop"	Calling async from sync code	Use await or asyncio.run()
Validation errors not clear	Missing field descriptions	Add Field(description=...)
Slow response times	Sync database calls	Switch to async SQLAlchemy
CORS errors in browser	Missing middleware	Add CORSMiddleware
Dependency not injected	Wrong import or syntax	Check Depends() syntax

Production Readiness

Security Configuration

from fastapi.middleware.cors import CORSMiddleware
from slowapi import Limiter

app = FastAPI(
    title="My API",
    docs_url="/docs" if os.getenv("ENV") != "production" else None,
)

limiter = Limiter(key_func=get_remote_address)
app.state.limiter = limiter

app.add_middleware(
    CORSMiddleware,
    allow_origins=os.getenv("ALLOWED_ORIGINS", "").split(","),
    allow_credentials=True,
    allow_methods=["GET", "POST", "PUT", "DELETE", "PATCH"],
    allow_headers=["*"],
)

Health Checks

@app.get("/health")
async def health():
    return {"status": "healthy"}

@app.get("/ready")
async def readiness(db: Session = Depends(get_db)):
    try:
        db.execute("SELECT 1")
        return {"status": "ready", "database": "connected"}
    except Exception:
        return JSONResponse(status_code=503, content={"status": "not ready"})

Graceful Shutdown

from contextlib import asynccontextmanager

@asynccontextmanager
async def lifespan(app: FastAPI):
    await database.connect()
    yield
    await database.disconnect()

app = FastAPI(lifespan=lifespan)

Monitoring Metrics

Metric	Alert Threshold
Request latency p99	> 500ms
Error rate (5xx)	> 1%
Memory usage	> 80%
Worker utilization	> 90%

Checklist

• CORS properly configured
• Rate limiting enabled
• Security headers middleware
• Pydantic validation on all inputs
• Health/readiness/liveness endpoints
• Structured logging (JSON format)
• Global exception handler
• Secrets via environment variables
• Docs disabled in production
• Gunicorn with multiple workers
• Graceful shutdown handling

Reference Documentation

• Pydantic Models
• Dependencies