Identify the consumers
List who and what will call the API: internal services, external partners, mobile clients or public third parties. Each consumer type has different trust, rate and versioning requirements.
Define the contract
Agree the endpoints, request shapes, response formats, error codes and versioning strategy. An agreed contract is more useful than an auto-generated schema after the fact.
Specify auth and access
Document who can read, write or delete which resources. Define token types, scopes and session lifetimes.
Agree operational requirements
Set rate limits, latency budgets, uptime targets and a deprecation policy before development. Retrofitting these is harder and more disruptive.
Make it specific to your situation.
Use this guide as a starting point. The next useful step is to record the real context, identify the decisions that need an owner and agree what evidence would support the decision.