Download the PHP package didasto/apilot without Composer

Apilot — Rest API Package for Laravel

Rapid REST API development with model-based and service-based CRUD controllers, automatic OpenAPI 3.0.3 documentation, and a flexible hook system.

Features

• Model-based CRUD — Extend ModelCrudController, set $model, get five fully working endpoints with zero boilerplate.
• Service-based CRUD — Extend ServiceCrudController and implement CrudServiceInterface for non-Eloquent data sources (external APIs, custom repositories).
• Lifecycle hooks — Intercept and modify any CRUD operation via a comprehensive set of hooks (beforeStore, afterStore, modifyIndexQuery, beforeDestroy, …).
• Automatic filtering, sorting, and pagination — Declare allowed fields; the package handles the query logic.
• OpenAPI 3.0.3 generation — Live spec at /api/doc, exportable via Artisan command, with optional built-in validation.
• Attribute-based documentation — #[OpenApiMeta] and #[OpenApiProperty] for fine-grained spec control.

Requirements

• PHP 8.3+
• Laravel 12.x or 13.x

Installation

If your application does not use package auto-discovery, register the provider manually in config/app.php:

Publish the configuration file:

Quick Start

Model-based Controller

1. The Eloquent model (app/Models/Post.php):

2. The controller (app/Http/Controllers/Api/PostController.php):

3. The route (routes/api.php):

First request:

Service-based Controller

Use this approach when data lives outside your database — an external REST API, a legacy system, or a custom repository.

1. The service (app/Services/ProductService.php):

2. The controller (app/Http/Controllers/Api/ProductController.php):

3. The route:

Configuration

All options are in config/apilot.php:

Filtering

Declare allowed filters in your controller:

Filter types:

Empty filter values (?filter[status]=) are silently ignored.

Sorting

Declare allowed sort fields in your controller:

Request format: ?sort=field (ascending) or ?sort=-field (descending). Multiple fields: ?sort=status,-created_at.

Undeclared sort fields and array injections (?sort[]=title) are silently ignored.

Pagination

All index endpoints return paginated responses.

Response format:

Non-numeric or negative per_page values fall back to the configured default. The value is capped at max_per_page. Non-numeric or negative page values default to 1.

Hook System

Override any hook method in your controller to intercept or modify the CRUD lifecycle.

Hook Reference

Hook Execution Order

index: modifyIndexQuery → filtering → sorting → pagination → afterIndex → resource mapping → transformResponse

show: afterShow → resource wrap → transformResponse

store: validation → beforeStore → model create → afterStore → resource wrap → transformResponse

update: find → validation → beforeUpdate → model update → afterUpdate → resource wrap → transformResponse

destroy: find → beforeDestroy (false = 403) → delete → afterDestroy

Example: Typical Hook Usage

OpenAPI Documentation

Live Spec

A live OpenAPI 3.0.3 spec is available at /api/doc (JSON) once routes are registered. Use it with Swagger UI:

Artisan Command

SDK generation example:

OpenAPI Attributes

#[OpenApiMeta] — Override the controller-level spec metadata:

#[OpenApiProperty] — Override schema properties derived from a FormRequest:

Middleware

ForceJsonResponse

By default, Laravel returns an HTML error page when a request is missing the Accept: application/json header. The ForceJsonResponse middleware prevents this by forcing the header on every request.

The middleware is registered as a named alias apilot.json and is not applied automatically. Apply it where needed:

CrudServiceInterface

Implement this interface when using ServiceCrudController:

PaginationParams carries $page (int) and $perPage (int).

PaginatedResult constructor: __construct(array $items, int $total, int $perPage, int $currentPage).

API Response Formats

Success Responses

200 — Single resource (show, update):

200 — Collection (index):

201 — Created resource (store):

204 — No content (destroy): Empty response body.

Error Responses

404 — Resource not found:

403 — Action not allowed (beforeDestroy returned false):

422 — Validation error:

Documentation

Full documentation is available in the docs/ directory:

• Installation
• Quick Start
• Model CRUD Controller
• Service CRUD Controller
• Route Registration
• Filtering
• Sorting
• Pagination
• Hooks
• OpenAPI Generation
• Middleware
• Error Handling
• Configuration
• Testing
• Advanced Examples

Testing

Changelog

See CHANGELOG.md.

License

MIT. See LICENSE.