Download the PHP package padosoft/laravel-rebel-admin-api without Composer

On this page you can find all versions of the php package padosoft/laravel-rebel-admin-api. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of padosoft/laravel-rebel-admin-api

Informations about the package laravel-rebel-admin-api

Laravel Rebel — Admin API

Official documentation: https://doc.laravel-rebel.padosoft.com

A control-plane JSON API for your auth security. Rebel writes every login, OTP, step-up and channel decision into one audit trail; this package turns that into a clean, permission-gated, tenant-aware read API: hourly metrics, a security overview, and a filterable audit-event explorer — ready to power a dashboard. Part of the padosoft/laravel-rebel-* suite.

Laravel 12|13 PHP 8.3+ PHPStan max Pest 4 MIT

Table of contents

What it is

The read side of the Rebel control plane. It does not authenticate end users; it lets your operators/SREs observe what the auth stack is doing — totals, funnels, and the raw event log — over a JSON API that a dashboard (or your own tooling) can consume.

It ships a metrics projector that aggregates the raw rebel_auth_events log into hourly buckets, and read-model endpoints that serve those buckets and the event log, all gated by a configurable guard + ability and scoped per tenant.

Depends on padosoft/laravel-rebel-core (the audit log + tenancy). The matching web UI lives in laravel-rebel-admin.

Quick glossary

Term In plain words
Control plane The "operate & observe" layer, as opposed to the user-facing login flow.
Metric bucket An hourly count of events of one type/channel (a pre-aggregate, so dashboards are fast).
Projector The job that turns raw events into buckets.
Read model An endpoint that only reads/aggregates — never mutates.
Ability A Laravel Gate check; here it gates access to the whole API.

Why this package

★ What In short
★★★ Dashboard-ready read models Health, security overview, and an audit explorer — JSON, paginated, filterable.
★★★ Fail-closed authorization Out of the box NOBODY gets in until you grant the rebel-admin ability — no accidental open admin API.
★★★ Tenant-aware, explicitly Looks across tenants for a super-admin, or ?tenant=<id> to scope — never a silent ambient leak.
★★ Cheap at scale A streaming, idempotent projector pre-aggregates the log; overviews are DB-aggregated, not loaded into PHP.
★★ Privacy-first Identifiers/IPs are HMAC'd at rest (by core); the API never returns plaintext PII.
★★ Robust pagination A validated compound (created_at, id) keyset cursor — no skipped rows on timestamp ties.

Rebel Admin API vs the alternatives

Building an auth-observability dashboard, compared:

Capability Rebel Admin API Shopify Generic admin panel (Nova/Filament) on raw tables Hand-rolled queries
Purpose-built auth metrics/funnels ✅ ❌ ❌ ➖
Pre-aggregated hourly buckets (fast) ✅ ❌ ❌ ❌
Fail-closed authorization by default ✅ ➖ ➖ ❌
Explicit cross-tenant vs scoped reads ✅ ❌ ❌ ❌
No plaintext PII exposure ✅ ➖ ➖ (depends) ➖
Validated keyset pagination ✅ ➖ ➖ ❌
Versioned, documented JSON contract ✅ ➖ ❌ ❌
Self-hosted, runs in your app ✅ ❌ ✅ ✅

Legend: ✅ built-in · ➖ partial / hosted-only / DIY · ❌ not available. A generic CRUD panel over the raw tables can show rows, but it won't give you funnels, fail-closed access, tenant-explicit reads or pre-aggregation — that's what this package is for. Shopify is a closed, hosted commerce platform: it offers a hosted admin over its own data, but you can't self-host it, query a tenant-scoped read API of your own auth events, or consume an OpenAPI contract for these primitives — it's a black box, not a library.

Installation

Grant access by defining the rebel-admin Gate (fail-closed by default):

Schedule the projector hourly:

Configuration

File config/rebel-admin-api.php:

Key Default What it does
prefix rebel/admin/api/v1 Where the endpoints are mounted.
guard '' Auth guard to require ('' = app default).
ability rebel-admin Gate ability to require. Fail-closed: empty it only if your guard already implies admin.
middleware [] Base middleware applied before the EnsureAdmin gate.

Endpoints

All under {prefix} and gated by EnsureAdmin. Add ?tenant=<id> to scope to one tenant.

Most list endpoints accept the shared query parameters tenant, from, to, granularity (minute|hour|day) — or the days shorthand — and endpoint-specific filters.

Method & path Section Returns
GET /me identity { id, permissions: [...] }
GET /health — { status, events_total, buckets_total, last_event_at }
GET /security/overview §3.1 { period, generated_at, kpis{…}, timeseries, open_anomalies, providers }
GET /otp/funnel?channel=&guard= §3.2 { stages: [...], resend_rate }
GET /step-up/funnel?purpose= §3.2 { by_purpose: [...] }
GET /channels/performance?channel=&provider= §3.3 { rows: [...], timeseries } — real per-channel sent / verify_conversion, plus delivered_rate + cost_amount/cost_currency derived from channel.verification.delivered events (provider status webhooks, e.g. Twilio). Latency stays null until captured — never fabricated
GET /providers/health §3.4 { providers: [...] }
GET /auth-events?... §3.5 { data, per_page, next_before, next_before_id } — each row includes country, ip_hmac, user_agent_hash
GET /auth-events/{id} §3.5 { data: { …, country, ip_hmac, user_agent_hash, metadata (sanitized) } }
GET /subjects?per_page= §3.6 { data: [ { subject, masked, devices, sessions, last_seen_at } ], meta } — searchable subject list (masked ids, never raw PII)
GET /subjects/{subject}/devices §3.6 { devices: [...] }
GET /subjects/{subject}/sessions §3.6 { sessions: [...] }
POST /subjects/{subject}/sessions/{id}/revoke §3.6 { revoked: true }
POST /subjects/{subject}/logout-everywhere §3.6 { revoked: <n> }
POST /subjects/{subject}/devices/{id}/untrust §3.6 { untrusted: true }
GET /risk-rules §3.7 { rules: [...] }
POST /risk-rules §3.7 { rule: {…} } (persisted as a draft by default)
POST /risk-rules/simulate §3.7 { decision, required_assurance, require_phishing_resistant, allowed_drivers, matched_rules, reasons }
GET /anomalies?type=&severity=&status=&cursor= §3.8 { data: [{ …, signals, suggested_actions }], meta: { next_cursor, has_more } } — ≥ 0.1.8: signals + suggested_actions travel in the list (the panel drawer reads them from here); delegation cases (delegation_exchange_burst, delegation_scope_probing from rebel-ai-guard ≥ 0.1.3) carry a destructive suspend_agent action
GET /anomalies/{case} §3.8 { id, type, severity, status, signals, timeline, suggested_actions }
POST /anomalies/{case}/actions §3.8 { ok, action } (mitigate requires confirm:true)
POST /ai/anomalies/{case}/explain §3.9 { explanation, confidence, sources }
POST /ai/policies/suggest §3.9 { draft_rule, rationale }
GET /compliance/overview §3.10 { nist, amr, psd2, gdpr } — amr is the real factor distribution (otp/passkey/…) flattened from the event log
GET /settings · PUT /settings/{key} — tenant-scoped key/value settings

Example:

The device/session, anomaly and AI endpoints read from the optional sibling packages (laravel-rebel-sessions, laravel-rebel-ai-guard, laravel-rebel-step-up). When a package is not installed the corresponding endpoints return an honest empty state / 404 — they never error.

The metrics projector

rebel:project-metrics {--hours=2} aggregates the raw event log into rebel_metric_buckets. It streams events (constant memory), truncates each to the hour, and upserts — so re-running over an overlapping window simply corrects late-arriving counts. Run it hourly; the default 2-hour window re-projects the current and previous hour.

Security notes

.env.example

Web Admin Panel

This API powers the Laravel Rebel Web Admin Panel (the laravel-rebel-admin package) — a ready-made dashboard over these read models (security overview, funnels, event explorer, provider health). The API is fully usable on its own for custom tooling.

🔋 Vibe coding with batteries included

This package ships AI batteries — so you (and your AI agent) can extend it correctly on the first try:

Open the repo in your AI editor and just start — the rules, guardrails and extension recipes come with it. PRs that follow the shipped CLAUDE.md pass CI (PHPStan max + Pest + Pint) and review the first time around.

Testing & License

License: MIT — see padosoft/laravel-rebel suite.

All versions of laravel-rebel-admin-api with dependencies

PHP Build Version
Package Version
Requires php Version ^8.3
illuminate/contracts Version ^12.0|^13.0
illuminate/support Version ^12.0|^13.0
padosoft/laravel-rebel-core Version ^0.1
spatie/laravel-package-tools Version ^1.92
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package padosoft/laravel-rebel-admin-api contains the following files

Loading the files please wait ...