typical API "request -> ... -> response" flow

api.md

router          <- method + URL
authentication  <- middleware
controller      <- function/class
  request         <- object
  command         <- pattern
    validation      <- rules
    CRUD/search     <- models
    authorization   <- throwing exception
    quota           <- filter
  response        <- object
logger          <- middleware