Download the PHP package yoosuf/laravel-api without Composer
On this page you can find all versions of the php package yoosuf/laravel-api. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download yoosuf/laravel-api
More information about yoosuf/laravel-api
Files in yoosuf/laravel-api
Package laravel-api
Short Description High-performance Laravel API toolkit with OpenAPI 3 generation, interactive docs UI, and consistent response helpers.
License MIT
Homepage https://github.com/yoosuf/laravel-api
Informations about the package laravel-api
yoosuf/laravel-api
Production-ready Laravel API toolkit: consistent response envelopes, structured error formats, OpenAPI 3 generation, request correlation, API versioning, exception rendering, paginator adapters, ETag helpers, security headers, and a health check endpoint — all in one package.
Features
Response building
- Unified
ApiResponderwith every standard HTTP status shortcut (200–503) - Two error formats:
envelope(ok / type / message / data / errors) andstructured(error.code / message / target / details / innererror) - Paginated collection responses with OData-lite shape (
value / @count / @nextLink / @prevLink) and RFC 5988Linkheader LengthAwarePaginatorandCursorPaginatoradapters (fromPaginator()/fromCursorPaginator())Locationheader oncreated()andaccepted()(RFC 7231)Retry-Afterheader on 429 / 503X-RateLimit-Limit / Remaining / Reseton 429- ETag generation, conditional-request checking, and
304 Not Modified - Configurable envelope keys, default messages, and pagination keys
Middleware
laravel-api.force-json— forcesAccept: application/jsonso exceptions render as JSON, not HTMLlaravel-api.request-id— attachesX-Request-IDandX-Correlation-IDto every request and responselaravel-api.security-headers—X-Content-Type-Options,X-Frame-Options,Cache-Control,Referrer-Policylaravel-api.versioning— reads and validates?api-version=orApi-Version:headerlaravel-api.deprecation— setsDeprecation:andSunset:headers on retiring routes
Exception handling
ApiExceptionRendererconvertsAuthenticationException,AuthorizationException,ValidationException,ModelNotFoundException,HttpException, and genericThrowableinto consistent API responses- Opt-in auto-registration via
LARAVEL_API_EXCEPTIONS_AUTO_RENDER=true
OpenAPI generation
- Route-driven OpenAPI 3.0.3 spec from Laravel routes
- Tags auto-inferred from controller class name (
OrderController→orders) - Auth middleware (
auth:sanctum,auth:api, etc.) →security: [{ bearerAuth: [] }] - Standard reusable response definitions auto-added to
components.responses - Standard error schemas (
ErrorEnvelope,StructuredError) incomponents.schemas FormRequestrules →requestBodyschema inferenceJsonResource/ResourceCollection→ response schema inference- JSON and YAML export, runtime endpoints, optional Swagger UI / Redoc
- Spec caching with configurable store and TTL
Health check
GET /_healthendpoint (configurable route, middleware, and on/off toggle)
Testing utilities
ApiResponseAssertionstrait for fluent test assertions (assertApiSuccess,assertApiPaginated,assertStructuredError, etc.)
Installation
Path repository (monorepo / local)
Add the path repository in root composer.json:
Require and publish:
Packagist (once published)
Quick start
1. Register recommended middleware
In app/Http/Kernel.php, add to the api middleware group:
Or use the named aliases registered by the package:
2. Auto-register exception rendering (optional)
In .env:
Or register manually in AppServiceProvider::boot():
This converts AuthenticationException, ValidationException, ModelNotFoundException, and HttpException into consistent JSON API responses automatically.
3. Use HasApiResponses in controllers
4. Or use the Facade / helpers directly
Response formats
Envelope format (default)
Success:
Error:
Structured format
Set LARAVEL_API_ERROR_FORMAT=structured to use the structured error format for all error responses:
Use structuredError() explicitly regardless of format setting:
Paginated response
Response also includes Link: <url>; rel="next", <url>; rel="prev" header (RFC 5988).
All response methods
Success
| Method | Status | Notes |
|---|---|---|
success($data, $message, $status, $meta) |
200 | Base success |
created($data, $message, $meta, $location) |
201 | Sets Location header |
accepted($data, $message, $meta, $location) |
202 | Sets Location header |
noContent() |
204 | Empty body |
paginated($items, $total, $nextLink, $prevLink) |
200 | OData-lite + Link header |
fromPaginator($paginator) |
200 | From LengthAwarePaginator |
fromCursorPaginator($paginator) |
200 | From CursorPaginator (no @count) |
Client errors (4xx)
| Method | Status |
|---|---|
badRequest($message, $errors, $meta) |
400 |
unauthorized($message, $errors, $meta) |
401 |
forbidden($message, $errors, $meta) |
403 |
notFound($message, $errors, $meta) |
404 |
conflict($message, $errors, $meta) |
409 |
gone($message, $errors, $meta) |
410 |
validation($messageOrException, $errors, $meta) |
422 |
unprocessable($message, $errors, $meta) |
422 |
locked($message, $errors, $meta) |
423 |
tooManyRequests($message, $errors, $meta, $retryAfter, $limit, $remaining, $reset) |
429 |
Server errors (5xx)
| Method | Status |
|---|---|
error($message, $status, $errors, $meta) |
5xx |
notImplemented($message, $errors, $meta) |
501 |
serviceUnavailable($message, $errors, $meta, $retryAfter) |
503 |
ETag / conditional requests
Middleware reference
ForceJsonMiddleware
Forces Accept: application/json so every request — including framework-level errors — returns JSON.
RequestIdMiddleware
Attaches X-Request-ID and X-Correlation-ID to every request and response.
SecurityHeadersMiddleware
Adds X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Cache-Control: no-store, Referrer-Policy: strict-origin.
ApiVersionMiddleware
Reads ?api-version= or Api-Version: header. Returns a structured 400 for unsupported versions.
Config: laravel-api.versioning.supported = ['1.0', '2.0']
DeprecationMiddleware
Signals deprecation and removal date on a route group.
Sets Deprecation: and Sunset: response headers automatically.
Exception rendering
| Exception | Status |
|---|---|
AuthenticationException |
401 |
AuthorizationException |
403 |
ValidationException |
422 with full error bag |
ModelNotFoundException |
404 with model name |
HttpException |
matching status |
Throwable |
500 (message hidden in production, shown with APP_DEBUG=true) |
Only renders for requests that send Accept: application/json or match api/*.
Health check
Enabled by default at GET /_health:
OpenAPI generation
Generate files
Auto-generated spec features
Every generated spec includes:
- Tags inferred from controller name (
OrderController→orders) bearerAuthsecurity scheme when any route uses auth middlewaresecurity: [{ bearerAuth: [] }]on auth-gated operations- Standard response refs:
401,403,404(path-param routes),422(POST/PUT/PATCH),429,500on every operation ErrorEnvelopeandStructuredErrorschemas incomponents.schemasrequestBodyinferred fromFormRequestrules- Response schemas inferred from
JsonResource/ResourceCollectionreturn types
Runtime endpoints
Schema providers
Operation overrides
Testing with ApiResponseAssertions
Add the trait to your test case for fluent API response assertions:
Available assertions:
| Method | Description |
|---|---|
assertApiSuccess($response, $status) |
ok=true, envelope structure |
assertApiCreated($response) |
201 + envelope |
assertApiAccepted($response) |
202 + envelope |
assertApiNoContent($response) |
204 |
assertApiPaginated($response) |
value + @count |
assertApiError($response, $status) |
ok=false |
assertApiValidationError($response, $field) |
422 + optional field check |
assertApiUnauthorized($response) |
401 |
assertApiForbidden($response) |
403 |
assertApiNotFound($response) |
404 |
assertApiTooManyRequests($response, $retryAfter) |
429 + Retry-After |
assertStructuredError($response, $code, $status) |
structured format |
assertApiDataKey($response, $key, $value) |
data.key value |
assertApiMeta($response, $key, $value) |
meta.key value |
assertApiHasRequestId($response) |
X-Request-ID header |
Configuration reference
Full config is in config/laravel-api.php. Key sections:
| Key | Default | Description |
|---|---|---|
openapi.enabled |
true |
Enable OpenAPI generation |
openapi.title |
app name | Spec title |
openapi.version |
1.0.0 |
Spec version |
openapi.default_path_prefix |
/api |
Route prefix filter |
openapi.cache.enabled |
false |
Cache generated spec |
openapi.docs_route.enabled |
true |
Serve runtime JSON/YAML |
openapi.docs_ui.enabled |
false |
Enable Swagger/Redoc UI |
response.error_format |
envelope |
envelope or structured |
response.envelope.* |
— | Configurable response keys |
response.pagination.* |
— | OData-lite key names |
request_id.enabled |
true |
Attach correlation headers |
request_id.header |
X-Request-ID |
Request ID header name |
versioning.enabled |
false |
Validate api-version |
versioning.supported |
[] |
Whitelist (empty = accept all) |
exceptions.auto_render |
false |
Auto-register exception renderer |
health.enabled |
true |
Enable health endpoint |
health.route |
_health |
Health check URL path |
Quality checks
Run from the package directory:
Changelog and upgrade
- Changelog:
CHANGELOG.md - Upgrade notes:
UPGRADE.md - Versioning policy:
docs/SEMVER_POLICY.md
Project documents
LICENSE— MITCONTRIBUTING.mdCODE_OF_CONDUCT.mdSECURITY.mdSUPPORT.md
Features
- Generate OpenAPI 3.0.3 specs from Laravel routes
- Export JSON and YAML spec files
- Serve live docs endpoints for JSON and YAML
- Configurable metadata, server URL, and API path prefix
- Action-based request and response mapping
- Route/action operation overrides (summary, tags, security, and more)
- Reusable
components.schemasregistry with provider support - Auto-inference from
JsonResource/ResourceCollectionreturn types - FormRequest validation rule inference for request schemas
- Route filtering by name and middleware from CLI options
- Optional static docs UI (Swagger UI or Redoc)
- Unified API response helpers (success, failed, error, validation, and aliases)
Installation (local path repository)
-
Add path repository in root
composer.json: -
Require package:
-
Publish config:
- (Optional) Publish docs UI assets:
Commands
Generate both outputs to configured paths:
Generate only JSON:
Generate YAML to custom file:
Limit generation to a prefix:
Generate with route filters:
Runtime endpoints
GET /openapi.jsonGET /openapi.yaml
Optional docs UI route:
GET /api-docs
Routes are configurable in config/laravel-api.php.
End-to-end quick start
-
Install the package and publish the config:
-
Enable the human-readable docs UI in
config/laravel-api.php: -
Publish the UI assets:
-
Generate the OpenAPI artifacts:
- Open the machine-readable and human-readable endpoints:
http://127.0.0.1:8000/openapi.jsonhttp://127.0.0.1:8000/openapi.yamlhttp://127.0.0.1:8000/api-docs
The integration guide in docs/PROJECT_INTEGRATION_GUIDE.md demonstrates that full flow with real endpoints and payloads.
API response helpers
Use the responder to avoid repeating JSON response structures in controllers.
Options:
- Facade:
ApiResponse::responseSuccess(...) - Helper:
response_success(...) - Service:
app('laravel-api.response')->success(...) - Trait:
Yoosuf\\LaravelApi\\Concerns\\HasApiResponses
Examples:
Alias support (including user-requested typo compatibility):
responseSuccessresponseFailedresponseErrorresponseErrror
Quality and CI
Run package quality checks from the package directory:
GitHub Actions workflow is provided at .github/workflows/laravel-api-quality.yml.
Versioning policy
This package follows Semantic Versioning.
- MAJOR: backward-incompatible API changes.
- MINOR: backward-compatible feature additions.
- PATCH: backward-compatible bug fixes.
Public API surface is defined in docs/SEMVER_POLICY.md.
Upgrade and changelog
- Changelog:
CHANGELOG.md - Upgrade notes:
UPGRADE.md
Open source project documents
- License:
LICENSE - Contributing:
CONTRIBUTING.md - Code of Conduct:
CODE_OF_CONDUCT.md - Security Policy:
SECURITY.md - Support Guide:
SUPPORT.md - Detailed contributor workflow:
docs/CONTRIBUTING_GUIDELINES.md
Documentation map
- Architecture:
docs/ARCHITECTURE.md - Configuration reference:
docs/CONFIG_REFERENCE.md - Operations runbook:
docs/OPERATIONS_RUNBOOK.md - End-to-end use cases:
docs/END_TO_END_USE_CASES.md - SemVer and public API policy:
docs/SEMVER_POLICY.md - Release process:
docs/RELEASE.md - Future engineering pipeline:
docs/FUTURE_PIPELINE.md - Contribution process:
docs/CONTRIBUTING_GUIDELINES.md - Project integration guide:
docs/PROJECT_INTEGRATION_GUIDE.md
Release and publishing
Before tagging a release, run:
For monorepo-only usage, keep requiring via path repository.
For distribution, publish to Packagist using the process in docs/RELEASE.md.
Phase 2 configuration hooks
openapi.providers: class list for custom providers implementing:Yoosuf\\LaravelApi\\OpenApi\\Contracts\\SchemaProviderYoosuf\\LaravelApi\\OpenApi\\Contracts\\OperationOverrideProvider
openapi.action_map: map byController@methodto merge request/response schema fragments.openapi.overrides: operation overrides grouped byroutesandactions.openapi.components.schemas: reusable component schemas.