Role Api Placement

Put part API actions available to every consuming role in api/api/common. Put actions available only to a particular role in api/api/${role}. For example, place a post read action shared by site and admin APIs in common/post.js, and an admin-only post write action in admin/post.js. Keep authorization checks appropriate to each action; directory placement does not replace authorization.

Correct

blog/api/api/common/post.js: shared read actions
blog/api/api/admin/post.js: admin-only write actions

Incorrect

blog/api/api/admin/post.js: a read action needed by every role
blog/api/api/common/post.js: an admin-only write action

Fix

Move each shared action to the part’s common API directory and each role-specific action to the corresponding role directory. Keep shared business logic outside the transport files.