Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Public APIs raise the cost of mistakes. The design needs compatibility, security, observability, and client support from the beginning.
I would define stable resource-based endpoints, request and response DTOs, authentication, authorization scopes, and clear error responses. External clients need documentation, examples, rate limits, pagination, and idempotency for create operations. I would avoid leaking internal database models through the contract. The first version can be small, but it needs consistency because partners build against it.