Building REST APIs with Laravel

# CHAPTER 15

Building REST APIs with Laravel #

1. Introduction #

2. Learning Objectives #

• Define routes specifically for APIs.

• Return JSON responses and HTTP Status Codes.

• Understand API Controllers and Resource Routing.

• Implement basic API Token Authentication (Sanctum).

3. Beginner-Friendly Explanation #

4. The API Routes File #

use App\Http\Controllers\Api\ProductController;

// URL will be: site.com/api/products
Route::get('/products', [ProductController::class, 'index']);

5. Returning JSON from a Controller #

app/Http/Controllers/Api/ProductController.php

<?php
namespace App\Http\Controllers\Api;
use App\Http\Controllers\Controller;
use App\Models\Product;

class ProductController extends Controller
{
    public function index()
    {
        // Fetch all products
        $products = Product::all();

        // Laravel automatically converts this Eloquent Collection to JSON!
        return response()->json([
            &#039;status' => 'success',
            &#039;data' => $products
        ], 200); // 200 is the HTTP status code for "OK"
    }

    public function show($id)
    {
        $product = Product::find($id);

        if (!$product) {
            // Return a 404 error if the product doesn't exist
            return response()->json([
                &#039;status' => 'error',
                &#039;message' => 'Product not found'
            ], 404);
        }

        return response()->json([
            &#039;status' => 'success',
            &#039;data' => $product
        ], 200);
    }
}

*If you visit site.com/api/products in your browser, you will see a raw wall of text formatting like {"status":"success", "data":[{"id":1, "name":"Laptop"}]}.*

6. Handling POST Requests (Creating Data via API) #

public function store(Request $request)
{
    // Validate the incoming JSON payload
    $validated = $request->validate([
        'name' => 'required|string|max:255',
        'price' => 'required|numeric'
    ]);

    // Create the product
    $product = Product::create($validated);

    // 201 is the HTTP status code for "Created"
    return response()->json([
        'status' => 'success',
        'message' => 'Product created',
        'data' => $product
    ], 201); 
}

7. API Authentication (Laravel Sanctum) #

Protecting the API Route:

// Only mobile apps that send a valid Token can access this route!
Route::middleware('auth:sanctum')->get('/user/profile', function (Request $request) {
    return $request->user(); // Returns the logged-in user's JSON data
});

8. Testing APIs with Postman #

9. Best Practices #

• API Resources: As your app grows, you don't want to expose every column of your database (like is_admin or password_hash) in the JSON response. Laravel provides "API Resources" (php artisan make:resource ProductResource) that allow you to explicitly define exactly which fields are sent in the JSON box.

10. Common Mistakes #

• Returning HTML Errors in an API: If a database query fails in an API, Laravel's default behavior is to render a beautiful HTML error page. However, a mobile app expects JSON, so the HTML causes the mobile app to crash. You must ensure your API routes always return errors explicitly formatted as JSON.

11. Exercises #

1. 1. Explain the difference between routes/web.php and routes/api.php regarding what type of responses they are expected to generate.

12. Coding Challenges #

• Challenge: Write an API Controller method called destroy($id). It should find a product by its ID, delete it, and return a JSON response with a success message and an HTTP Status Code of 200.

13. MCQs with Answers #

14. Interview Questions #

• Q: Explain the purpose of Laravel Sanctum. How does Token-based authentication for APIs differ from Session-based authentication for web browsers?

• Q: What is an HTTP Status Code? Give examples of when you would return a 200, a 201, a 404, and a 422 in an API endpoint.

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #