Download the PHP package rafalmasiarek/dashboard-kit-addon-api without Composer

On this page you can find all versions of the php package rafalmasiarek/dashboard-kit-addon-api. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of rafalmasiarek/dashboard-kit-addon-api

Informations about the package dashboard-kit-addon-api

dashboard-kit-addon-api

API plugin for rafalmasiarek/dashboard-kit. Adds Bearer token authentication with per-route scope enforcement, admin UI for token and scope management, user self-service token page, and a structured audit trail.

Requirements

Installation

The plugin is registered automatically when the package is installed. No additional configuration is required.

Features

Token authentication

Every versioned API route (/v1/...) is protected by a Bearer token:

Tokens are created by users from /settings/api-tokens or by admins from /admin/api/tokens.

Scope enforcement

Routes declare required scopes. A token must carry all required scopes to pass:

Super-scopes * and admin:* bypass all scope checks. Namespace wildcards (notes:*) satisfy any notes:{action} requirement.

Scope management

Admins define global scopes and assign subsets to individual users:

  1. Create scopes at /admin/api/scopes (e.g. notes:read, notes:write)
  2. Assign scopes to a user via Admin → Users → API Scopes
  3. User can now create tokens using only their assigned scopes
  4. Admins can create tokens with any scope regardless of assignments

JSON response envelope

All API responses follow a consistent shape:

Error responses:

Audit trail

Every API request is logged to the logger.api channel (falls back to logger.audit):

Token values are never logged in full — only the first 8 characters are stored as a correlation prefix.

Defining API routes

Routes are declared under the api key in module.php. The contract — parameters, request body, and responses — is defined once at the top level. The framework uses it for both OpenAPI generation and runtime behavior: type casting, error map derivation, and response envelope building.

Handler return shape

Return value Result
['data' => $payload] 200 OK
['data' => ..., 'http' => 201, 'message' => 'Created'] Custom status and message
['error' => 'CODE'] HTTP status and message from responses declaration
['error' => 'CODE', 'message' => 'Custom message.'] Overrides the message from responses
['error' => 'CODE', 'field' => 'email', 'detail' => '...'] Adds field and detail to errors[0]
['error' => 'CODE', 'http' => 410] Overrides the HTTP status from responses

field and detail are appended to the errors array alongside code:

All override keys can be combined freely:

What the framework does automatically

params

Declares path and query parameters. The type field drives both OpenAPI and runtime casting:

Supported types: integer, number, boolean, string.

body

Optional. Declares the JSON schema of the request body. Used as the OpenAPI requestBody schema and made available to the handler as $body:

The framework validates the body before calling the handler and returns an error if the structure is invalid:

Error code HTTP Condition
MALFORMED_JSON 400 Content-Type: application/json sent with non-JSON content
INVALID_BODY_TYPE 400 Body root type does not match the declared type
INVALID_FIELD_TYPE 422 A declared property has the wrong type

These errors are returned by the framework directly — they do not need to be listed in the route's responses declaration.

responses

Declares all possible response codes. Entries with a 'code' key become part of the runtime error map; entries with a 'schema' key describe the data payload in the OpenAPI spec:

pagination

Optional. Enables automatic pagination for list endpoints. When declared, the framework injects page, limit, and offset into $params and computes the pagination envelope field from the total key returned by the handler:

Client query params: ?page=2&per_page=10. The response includes a top-level pagination object:

The pagination field is absent from non-paginated endpoints. The OpenAPI spec automatically includes page and per_page query parameters and a representative pagination example for 2xx responses.

OpenAPI specification

A full OpenAPI 3.1 spec is generated automatically from all module route definitions and served at a configurable endpoint:

The openapi sub-key on a route carries documentation-only metadata:

Standard 401/403 responses are auto-injected for all routes that declare scopes.

Other plugins can extend the spec when the API plugin is installed:

To use a dedicated log channel, add logger.api to your dashboard-kit logging configuration:

Admin routes

Route Description
GET /admin/api/scopes List all scopes
POST /admin/api/scopes Create a scope
POST /admin/api/scopes/{id}/delete Delete a scope
GET /admin/api/tokens List all tokens (all users)
POST /admin/api/tokens Create a token (any scope)
POST /admin/api/tokens/{token}/revoke Revoke any token
GET /admin/api/users/{id}/scopes View/edit scope assignments for a user
POST /admin/api/users/{id}/scopes Save scope assignments

User routes

Route Description
GET /settings/api-tokens List own tokens, create new token
POST /settings/api-tokens Create token (assigned scopes only)
POST /settings/api-tokens/{token}/revoke Revoke own token

Database tables

Auto-migrated on first boot:

Table Description
user_tokens Issued tokens with optional subject and expiry
token_scopes Token → scope assignments
scopes Global scope registry (name, category, description)
user_scopes Per-user scope assignments

System tables managed by dashboard-kit core (never prefixed):

Table Description
_schema_state Schema hash per table — drives the schema sync fast path
_table_version Per-table write counters — drives SELECT cache invalidation
_query_cache Cached SELECT results with TTL

License

Business Source License 1.1 — see LICENSE. For alternative licensing, contact us.

All versions of dashboard-kit-addon-api with dependencies

PHP Build Version
Package Version
Requires php Version >=8.2
rafalmasiarek/dashboard-kit Version *
slim/slim Version ^4.0
slim/psr7 Version ^1.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package rafalmasiarek/dashboard-kit-addon-api contains the following files

Loading the files please wait ...