API Routes

Last modified on: September 4, 2025

<h1 data-start="142" data-end="183">🔹 Laravel REST APIs &ndash; Complete Guide</h1>
<p data-start="185" data-end="348">A <strong data-start="187" data-end="233">REST API (Representational State Transfer)</strong> allows your application to communicate with other apps or frontend frameworks (like React, Vue, or mobile apps).</p>
<p data-start="350" data-end="451">Laravel makes building REST APIs super easy using <strong data-start="400" data-end="448">routes, controllers, Eloquent, and resources</strong>.</p>
<hr data-start="453" data-end="456" />
<h2 data-start="458" data-end="491">🛠️ 1. Setting Up API Routes</h2>
<p data-start="493" data-end="533">In Laravel, API routes are defined in:</p>
<p data-start="535" data-end="556">📌 <code data-start="538" data-end="554">routes/api.php</code></p>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>use Illuminate\Support\Facades\Route;
use App\Http\Controllers\Api\PostController;

Route::get('/posts', [PostController::class, 'index']);   // Get all posts
Route::get('/posts/{id}', [PostController::class, 'show']); // Get single post
Route::post('/posts', [PostController::class, 'store']);   // Create new post
Route::put('/posts/{id}', [PostController::class, 'update']); // Update post
Route::delete('/posts/{id}', [PostController::class, 'destroy']); // Delete post</code></pre>
</div>
</div>
</div>
</div>
<p data-start="1044" data-end="1175">👉 All these routes are automatically prefixed with <code data-start="1096" data-end="1102">/api</code>.<br data-start="1103" data-end="1106" />So <code data-start="1109" data-end="1117">/posts</code> will be available at <code data-start="1139" data-end="1172">http://127.0.0.1:8000/api/posts</code>.</p>
<hr data-start="1177" data-end="1180" />
<h2 data-start="1182" data-end="1217">🛠️ 2. Creating API Controller</h2>
<p data-start="1219" data-end="1243">Generate a controller:</p>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>php artisan make:controller Api/PostController --api</code></pre>
</div>
</div>
</div>
</div>
<p data-start="1311" data-end="1368">This creates an API-ready controller with CRUD methods.</p>
<hr data-start="1370" data-end="1373" />
<h3 data-start="1375" data-end="1410">Example: <code data-start="1388" data-end="1408">PostController.php</code></h3>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use App\Models\Post;

class PostController extends Controller
{
    // GET /api/posts
    public function index()
    {
        return response()-&gt;json(Post::all(), 200);
    }

// GET /api/posts/{id}
    public function show($id)
    {
        $post = Post::find($id);
        if (!$post) {
            return response()-&gt;json(['message' =&gt; 'Post not found'], 404);
        }
        return response()-&gt;json($post, 200);
    }

// POST /api/posts
    public function store(Request $request)
    {
        $validated = $request-&gt;validate([
            'title' =&gt; 'required|max:255',
            'content' =&gt; 'required',
        ]);

$post = Post::create($validated);
        return response()-&gt;json($post, 201);
    }

// PUT /api/posts/{id}
    public function update(Request $request, $id)
    {
        $post = Post::find($id);
        if (!$post) {
            return response()-&gt;json(['message' =&gt; 'Post not found'], 404);
        }

$post-&gt;update($request-&gt;all());
        return response()-&gt;json($post, 200);
    }

// DELETE /api/posts/{id}
    public function destroy($id)
    {
        $post = Post::find($id);
        if (!$post) {
            return response()-&gt;json(['message' =&gt; 'Post not found'], 404);
        }

$post-&gt;delete();
        return response()-&gt;json(['message' =&gt; 'Post deleted'], 200);
    }
}</code></pre>
</div>
</div>
</div>
</div>
<hr data-start="2890" data-end="2893" />
<h2 data-start="2895" data-end="2929">🛠️ 3. Post Model &amp; Migration</h2>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>php artisan make:model Post -m</code></pre>
</div>
</div>
</div>
</div>
<p data-start="2975" data-end="3044">📌 Migration file (<code data-start="2994" data-end="3041">database/migrations/...create_posts_table.php</code>)</p>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>public function up()
{
    Schema::create('posts', function (Blueprint $table) {
        $table-&gt;id();
        $table-&gt;string('title');
        $table-&gt;text('content');
        $table-&gt;timestamps();
    });
}</code></pre>
</div>
</div>
</div>
</div>
<p data-start="3267" data-end="3283">Run migration:</p>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>php artisan migrate</code></pre>
</div>
</div>
</div>
</div>
<p data-start="3318" data-end="3352">📌 Model (<code data-start="3328" data-end="3349">app/Models/Post.php</code>)</p>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;

class Post extends Model
{
    use HasFactory;

protected $fillable = ['title', 'content'];
}</code></pre>
</div>
</div>
</div>
</div>
<hr data-start="3583" data-end="3586" />
<h2 data-start="3588" data-end="3620">🛠️ 4. Testing with Postman</h2>
<ul data-start="3622" data-end="3945">
<li data-start="3622" data-end="3686">
<p data-start="3624" data-end="3686"><strong data-start="3624" data-end="3631">GET</strong> <code data-start="3632" data-end="3665">http://127.0.0.1:8000/api/posts</code> &rarr; Fetch all posts.</p>
</li>
<li data-start="3687" data-end="3854">
<p data-start="3689" data-end="3750"><strong data-start="3689" data-end="3697">POST</strong> <code data-start="3698" data-end="3731">http://127.0.0.1:8000/api/posts</code> &rarr; Create a post.</p>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>{
    "title": "My First Post",
    "content": "This is content of the post."
}</code></pre>
</div>
</div>
</div>
</div>
</li>
<li data-start="3855" data-end="3898">
<p data-start="3857" data-end="3898"><strong data-start="3857" data-end="3864">PUT</strong> <code data-start="3865" data-end="3879">/api/posts/1</code> &rarr; Update a post.</p>
</li>
<li data-start="3899" data-end="3945">
<p data-start="3901" data-end="3945"><strong data-start="3901" data-end="3911">DELETE</strong> <code data-start="3912" data-end="3926">/api/posts/1</code> &rarr; Delete a post.</p>
</li>
</ul>
<hr data-start="3947" data-end="3950" />
<h2 data-start="3952" data-end="4010">🛠️ 5. Using API Resources (Optional but Recommended)</h2>
<p data-start="4012" data-end="4076">To control the <strong data-start="4027" data-end="4046">response format</strong>, use <strong data-start="4052" data-end="4073">Laravel Resources</strong>.</p>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>php artisan make:resource PostResource</code></pre>
</div>
</div>
</div>
</div>
<p data-start="4130" data-end="4143">📌 Example:</p>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>// app/Http/Resources/PostResource.php
namespace App\Http\Resources;

use Illuminate\Http\Resources\Json\JsonResource;

class PostResource extends JsonResource
{
    public function toArray($request)
    {
        return [
            'id' =&gt; $this-&gt;id,
            'title' =&gt; $this-&gt;title,
            'content' =&gt; $this-&gt;content,
            'created_at' =&gt; $this-&gt;created_at-&gt;toDateString(),
        ];
    }
}
</code></pre>
</div>
</div>
</div>
</div>
<p data-start="4571" data-end="4599">Then use it in controller:</p>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>use App\Http\Resources\PostResource;

return PostResource::collection(Post::all());</code></pre>
</div>
</div>
</div>
</div>
<hr data-start="4697" data-end="4700" />
<h2 data-start="4702" data-end="4732">🛠️ 6. Securing REST APIs</h2>
<ul data-start="4734" data-end="4831">
<li data-start="4734" data-end="4811">
<p data-start="4736" data-end="4811">Use <strong data-start="4740" data-end="4759">Laravel Sanctum</strong> or <strong data-start="4763" data-end="4775">Passport</strong> for authentication (token-based).</p>
</li>
<li data-start="4812" data-end="4831">
<p data-start="4814" data-end="4831">Protect routes:</p>
</li>
</ul>
<div class="contain-inline-size rounded-2xl relative bg-token-sidebar-surface-primary">
<div class="sticky top-9">
<div class="absolute end-0 bottom-0 flex h-9 items-center pe-2">
<div class="bg-token-bg-elevated-secondary text-token-text-secondary flex items-center gap-4 rounded-sm px-2 font-sans text-xs">
<pre class="language-php"><code>Route::middleware('auth:sanctum')-&gt;group(function () {
    Route::post('/posts', [PostController::class, 'store']);
    Route::put('/posts/{id}', [PostController::class, 'update']);
    Route::delete('/posts/{id}', [PostController::class, 'destroy']);
});</code></pre>
</div>
</div>
</div>
</div>
<hr data-start="5101" data-end="5104" />
<h2 data-start="5106" data-end="5122">📌 Workflow</h2>
<ol data-start="5124" data-end="5392">
<li data-start="5124" data-end="5167">
<p data-start="5127" data-end="5167">User hits API endpoint &rarr; <code data-start="5152" data-end="5164">/api/posts</code>.</p>
</li>
<li data-start="5168" data-end="5215">
<p data-start="5171" data-end="5215">Route forwards request &rarr; <code data-start="5196" data-end="5212">PostController</code>.</p>
</li>
<li data-start="5216" data-end="5273">
<p data-start="5219" data-end="5273">Controller validates request &rarr; interacts with Model.</p>
</li>
<li data-start="5274" data-end="5333">
<p data-start="5277" data-end="5333">Model retrieves/updates data &rarr; sends response as JSON.</p>
</li>
<li data-start="5334" data-end="5392">
<p data-start="5337" data-end="5392">Client (Postman, frontend, mobile app) receives data.</p>
</li>
</ol>
<hr data-start="5394" data-end="5397" />
<h2 data-start="5399" data-end="5420">✅ Best Practices</h2>
<ul data-start="5422" data-end="5665">
<li data-start="5422" data-end="5471">
<p data-start="5424" data-end="5471">Always validate input (<code data-start="5447" data-end="5467">$request-&gt;validate</code>).</p>
</li>
<li data-start="5472" data-end="5514">
<p data-start="5474" data-end="5514">Use <strong data-start="5478" data-end="5491">Resources</strong> to format responses.</p>
</li>
<li data-start="5515" data-end="5563">
<p data-start="5517" data-end="5563">Use <strong data-start="5521" data-end="5541">Sanctum/Passport</strong> for authentication.</p>
</li>
<li data-start="5564" data-end="5609">
<p data-start="5566" data-end="5609">Use <strong data-start="5570" data-end="5588">API versioning</strong> (<code data-start="5590" data-end="5605">/api/v1/posts</code>).</p>
</li>
<li data-start="5610" data-end="5665">
<p data-start="5612" data-end="5665">Handle errors gracefully with <code data-start="5642" data-end="5662">response()-&gt;json()</code>.</p>
</li>
</ul>

Web Technology View More