# Laravel API

> REST and JSON API standards for modern Laravel backends.

- Skill: `diegosouzapw/laravel-api` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add diegosouzapw/laravel-api`
- Raw SKILL.md: https://api.skillmd.com/api/skills/diegosouzapw/laravel-api/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: diegosouzapw (https://skillmd.com/u/diegosouzapw)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/diegosouzapw/laravel-api

---


# Laravel API

## **Priority: P1 (HIGH)**

## Structure

```text
app/
└── Http/
    ├── Resources/      # Data transformation
    └── Controllers/
        └── Api/        # API specific logic
```

## Implementation Guidelines

- **API Resources**: Always use Resources/Collections for JSON formatting.
- **RESTful Actions**: Follow standard naming (`index`, `store`, `update`).
- **Auth**: Use **Sanctum** for SPAs/Mobile or **Passport** for OAuth2.
- **Status Codes**: Return appropriate HTTP codes (201 Created, 422 Unprocessable).
- **Versioning**: Prefix routes with version tags (e.g., `api/v1/...`).
- **Rate Limiting**: Configure `RateLimiter` to protect public endpoints.

## Anti-Patterns

- **Raw Models**: **No raw model returns**: Information leakage risk.
- **Manual JSON**: **No response()->create()**: Use API Resources.
- **Session Auth**: **No sessions for APIs**: Use Tokens (Sanctum).
- **Hardcoded URLs**: **No static links in JSON**: Use HATEOAS or route names.

## References

- [API Resource Patterns](references/implementation.md)