One stable shape
Make every request and response easy to guess. Use clear field names, consistent types, and the same wrapper style across your API.
Your teammate should not need to inspect your database to know what to send or what they will get back.
Requests are contracts
A request body is not a form dump. It is the minimum data your API needs to create or update a resource.
Do not accept fields that the server should decide, like id, createdAt, ownerId, or status if the user is not allowed to set it.