Laravel API Starter

Pure API package for Laravel 11 / 12 / 13. Service layer, UUID models, datatable macro, one-command CRUD scaffold + OpenAPI (Swagger).

Requires PHP ^8.3.

Features

• UUID primary keys (default v7, configurable to 1 / 4)
• JSON response envelope + pagination meta
• Service layer (BaseService, BaseServiceInterface)
• BaseApiController + API Resources
• Eloquent datatable() macro (search / sort / filter / date range)
• php artisan api:scaffold Post → model, migration, requests, service, controller, resource, routes, OpenAPI
• Auto-discovery via Composer; routes under routes/api-starter/ auto-loaded

Installation

composer require kindharika/laravel-api-starter

Publish config (optional):

php artisan vendor:publish --tag=api-starter-config
php artisan vendor:publish --tag=api-starter-stubs

Scaffold (ready-to-use CRUD)

php artisan api:scaffold Post
# or with migration:
php artisan api:scaffold Post --migrate

Creates:

Endpoints immediately available:

GET    /api/posts
POST   /api/posts
GET    /api/posts/{id}
PUT    /api/posts/{id}
DELETE /api/posts/{id}

Example body:

{ "name": "Hello", "description": "World" }

Individual generators:

php artisan api:make-model Post
php artisan api:make-controller PostController --model=Post
php artisan api:make-service PostService --model=Post
php artisan api:make-request Post
php artisan api:make-migration Post
php artisan api:make-resource Post
php artisan api:make-route Post
php artisan api:make-openapi Post

Swagger UI

After scaffold, package serves:

• UI: {APP_URL}/api/docs
• JSON: {APP_URL}/api/docs/openapi.json

Example output:

CRUD endpoints:
  GET    http://localhost/api/posts
  POST   http://localhost/api/posts
  ...

Swagger / OpenAPI:
  UI:   http://localhost/api/docs
  JSON: http://localhost/api/docs/openapi.json

Controllers also include @OA\* annotations for darkaonline/l5-swagger if you prefer that package.

Usage

Model

use Kindharika\ApiStarter\Base\BaseModel;

class Post extends BaseModel
{
    protected $table = 'posts';
    protected $fillable = ['name', 'description'];
}

Controller

use Kindharika\ApiStarter\Base\BaseApiController;

class PostController extends BaseApiController
{
    // sendSuccess() / sendError()
}

Datatable

$posts = Post::datatable($request->all())->paginate(15);

Optional Sanctum auth

Route folders

Existing files in routes/api-starter/ stay public. --auth writes only into api-starter-protected/.

php artisan api:scaffold Post                 # → routes/api-starter/posts.php (public)
php artisan api:scaffold CobaAuth --auth      # → routes/api-starter-protected/coba-auths.php

API_STARTER_AUTH=true only makes new scaffolds default to the protected folder — does not lock existing public routes.

Auth endpoints (login / register / forgot)

composer require laravel/sanctum
php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"
php artisan migrate
php artisan api:make-auth

User model gets HasApiTokens automatically via api:make-auth (skip with --skip-user-patch).

Swagger Authorize: paste token only (no Bearer prefix):

1|1qlzDsGAKirfga9dnDrvHDq8temeczVyB6d1T9LMe01fb8c8

If protected module still 401, regenerate OpenAPI security:

php artisan api:make-openapi CobaAuth --auth
php artisan optimize:clear

Remove a module

php artisan api:remove Post
php artisan api:remove CobaAuth --force
php artisan api:remove Post --keep-migration

Deletes model, controller, service, requests, resource, routes, OpenAPI. Migration deleted unless --keep-migration (rollback manually if already applied).

Configuration

return [
    'namespace' => 'App',
    'uuid_version' => 7, // 1 | 4 | 7 — use 4 for 1.x behavior
    'route_prefix' => 'api',
    'route_middleware' => ['api'],
    'auth' => [
        'enabled' => false, // new scaffolds default to --auth when true
        'guard' => 'sanctum',
    ],
    'datatable' => [
        'per_page' => 15,
        'search_operator' => 'auto', // auto | like | ilike
    ],
    'openapi' => [
        'enabled' => true,
        'title' => 'API Documentation',
        'version' => '1.0.0',
        'server_url' => '/api',
    ],
];

Versioning

SemVer. Breaking changes → major bump. See CHANGELOG.md.

composer require kindharika/laravel-api-starter:^2.0

Security notes

• Scaffold FormRequests validate name / description; tighten authorize() with policies for real apps
• Prefer $fillable on models (stubs do); avoid mass-assigning secrets
• Datatable search escapes % / _ wildcards; still whitelist search_columns in production

License

MIT