Download the PHP package zolta/http without Composer

Zolta HTTP

Declarative APIs. Zero boilerplate.

Define your entire HTTP pipeline — routing, validation, service binding, authorization, and response shaping — with PHP 8 attributes. Your controller methods stay empty. The framework does the wiring.

First-class Laravel (Symfony support coming soon) adapters. OpenAPI generation from the same attributes. Under 2ms pipeline overhead.

Why Zolta HTTP?

The problem

PHP frameworks give you routing and controllers, but the plumbing between "HTTP request" and "business logic" is still manual. Every endpoint repeats the same pattern: validate input → map to DTO → call service → transform result → shape response. This boilerplate multiplies across hundreds of endpoints, and every copy is a place for inconsistencies to hide.

What Zolta HTTP does differently

The key insight: your controller method shouldn't contain the pipeline — it should declare it. Five attributes replace what typically takes 30-50 lines of wiring code per endpoint.

Who is this for?

• Teams building API-first applications who are tired of repetitive controller boilerplate
• Projects targeting both Laravel and Symfony with shared HTTP logic
• Developers who want convention with escape hatches — use attributes for 90% of endpoints, drop to manual for the rest

Install

Laravel auto-discovers the service provider. For Symfony, register the bundle in config/bundles.php.

Identity token introspection (Laravel)

v2.1.0 adds optional remote Identity token validation. Publish the configuration, set IDENTITY_API_URL, IDENTITY_CLIENT_ID, and IDENTITY_CLIENT_SECRET, then protect a route with identity.introspect:

See the Identity module documentation for sandbox connections, permission checks, caching, and webhook signature verification.

The pipeline — from request to response

Every attribute-routed request flows through a deterministic pipeline:

Each step is independently replaceable. The entire pipeline adds < 2ms overhead on warm requests.

Quick start

1. Define a controller

Controllers are declaration sites, not logic containers. Each method declares what should happen via attributes — the framework handles how:

2. Define a form request

Authenticated actors, tenant identifiers, and other server-owned values belong in trustedData(). They are merged after validation and always replace client input with the same key:

Never accept an actor or tenant identifier from query parameters or the request body. The former withData() hook remains available as a deprecated migration bridge and is treated with the same trusted precedence.

3. Define an input DTO

4. Define a resource

Attribute reference

Authorization

Configure the AuthorizationMatrix to map abilities to permissions, with multi-path extraction from your user model:

Then reference abilities in your route attribute — authorization is checked before the service is invoked:

Response format

All responses follow a consistent envelope — success, error, and debug states share the same shape:

Exceptions are automatically normalized: domain exceptions (404, 409, 422) pass through with context; unexpected errors become safe 500 responses with debug trace in development mode.

What else is included

OpenAPI generation from attributes

The same #[Route], #[Request], #[Response], and #[Doc] attributes that drive runtime behavior also generate OpenAPI 3.0 specifications. No separate schema files to maintain — your docs always match your code.

Multi-tier reflection caching

Route metadata resolution uses a 3-tier cache: runtime memory → persistent store (Laravel Cache / APCu) → reflection fallback. Cold-start resolves once, then subsequent requests hit the cache at < 0.5ms.

Route caching with manifest tracking

AttributeRouteCache compiles routes into bootstrap/cache/attribute_routes.php with file-level tracking — only changed controllers trigger rebuilds.

Exception handling

The HandlesApiExceptions trait normalizes all exceptions into the standard response envelope. Domain exceptions (ValidationException, NotFoundException, ConflictException) carry structured error data; framework exceptions are safely wrapped.

File upload support

UploadedFileDTO provides a framework-neutral representation with clientOriginalName, clientMimeType, size, tmpPath, and error — works identically on Laravel and Symfony.

Performance

Benchmarked on a real application (Laravel 12, PHP 8.3, SQLite):

The rest of your request time is your application logic — Eloquent queries, external calls, business rules. The transport layer stays invisible.

Dual framework support

Every module has independent Laravel adapter (Symfony support is coming soon). The same controller code runs on either framework without modification.:

Write your controllers once, deploy on either framework.

QA

146 tests, 323 assertions covering routing attributes, authorization matrix, request mapping, response contracts, exception handling, caching, and security.

Part of the Zolta Ecosystem

Zolta HTTP is the transport layer — it wires HTTP to your application through clean attributes:

When used together: a request arrives → HTTP resolves the pipeline via attributes → Forge hydrates the command with validated VOs → CQRS dispatches through the bus, captures events, wraps transactions → HTTP transforms and returns the response. All of this happens with < 5ms of package overhead and zero manual wiring.

Documentation

Full documentation is available in the docs/ directory, organized for serving via Nuxt Content.

License

MIT © 2026 Redouane Taleb