A clean, predictable, and well-documented API powering your applications. Full resource control with token-based authentication.
Batteries-included API with auth, pagination, rate limiting, and comprehensive error handling.
Token-based authentication using Laravel Sanctum. Supports personal access tokens and SPA sessions.
Cursor and offset-based pagination on all collection endpoints with configurable page sizes.
Per-token rate limits with X-RateLimit-* headers on every response.
RFC 7807 problem details format. Every error includes a code, message, and field-level validation.
"data": [ { "id": 1, "name": "Jane Doe", "email": "jane@example.com" } ], "meta": { "total": 142, "last_page": 10 }
"data": { "id": 43, "name": "New User", "email": "new@example.com", "created_at": "2025-04-30T..." }
Full replacement of user record. All required fields must be included.
Permanently deletes the user and all associated records. Returns 204 No Content.
"token": "1|aB3cD4eF5...", "token_type": "Bearer", "expires_at": null
Creates a new post owned by the authenticated user. Requires Bearer token.
Partial update — only include fields to change. Returns the updated post object.
All endpoints (except login & register) require a Bearer token in the Authorization header.
curl -X GET \ https://yourapp.test/api/v1/users \ -H "Authorization: Bearer YOUR_TOKEN" \ -H "Accept: application/json" \ -H "Content-Type: application/json"
$client = new \GuzzleHttp\Client(); $response = $client->get('/api/v1/users', [ 'headers' => [ 'Authorization' => 'Bearer ' . $token, 'Accept' => 'application/json', ], ]);
const response = await fetch('/api/v1/users', { method: 'GET', headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/json', } });
GET requests only
POST, PUT, PATCH
DELETE requests
Full access
Requests are counted per token per minute. Headers are included on every response.
X-RateLimit-Limit: 300 X-RateLimit-Remaining: 287 X-RateLimit-Reset: 1746016860 Retry-After: 42 # only on 429
All error responses follow a consistent JSON structure with machine-readable codes.
"error": { "code": "VALIDATION_ERROR", "message": "The given data was invalid.", "fields": { "email": ["The email has already been taken."] } }
| HTTP | Code | Meaning |
|---|---|---|
| 200 | OK | Success |
| 201 | CREATED | Resource created |
| 401 | UNAUTHENTICATED | Missing or invalid token |
| 403 | UNAUTHORIZED | Token lacks scope |
| 422 | VALIDATION_ERROR | Invalid request data |
| 429 | RATE_LIMIT | Too many requests |
| 500 | SERVER_ERROR | Internal server error |