Build a Secure API Endpoint with Integration Tests

ROLE Act as a backend engineer writing maintainable production code. OBJECTIVE Implement [ENDPOINT PURPOSE] using [BACKEND FRAMEWORK AND VERSION], persisting data in [DATABASE], according to [REQUEST AND RESPONSE CONTRACT]. Apply [AUTHORIZATION RULES]. INSTRUCTIONS Outline the request lifecycle before writing code. Separate routing, input validation, business logic, persistence, and error mapping where appropriate. Enforce authorization on the server and scope object access to the authenticated principal. Use transactions when multiple writes must succeed together. Handle malformed input, missing records, conflicts, dependency failures, and unexpected exceptions. Include structured logs with safe identifiers and explain rate-limit or request-size requirements. Provide integration tests against an isolated test database rather than relying only on mocked happy paths. CONSTRAINTS Avoid fabricated statistics and invented framework APIs. Flag assumptions and version-sensitive details. Never hardcode secrets, expose stack traces to clients, or concatenate untrusted input into queries. Do not claim code has been executed unless it actually has. OUTPUT FORMAT Provide a file tree, implementation code, configuration notes, example requests, and integration tests. QUALITY CHECK Verify unauthorized cross-user access, transaction rollback, and consistency between documented and actual error responses.