Building Robust RESTful APIs with Laravel

Start with the shape of your responses

The fastest way to make an API pleasant to consume is a stable response shape. Laravel's API resources give you a single place to define it, so the frontend never has to guess whether a payload is an object, an array, or something in between.

Validation belongs in Form Requests

Writing rules inside the controller works, but it stops scaling. Extract them into a Form Request so that validation, authorisation and rules live next to each other and can be tested in isolation.

Keep rules close to the domain they describe.
Return the default 422 error shape; most clients already parse it.
Add a couple of custom rules for the weird cases instead of piling conditions into the controller.

Rate limiting is a safety feature, not a niche

A public write endpoint is a spam magnet until you throttle it. Prefix the route with a reasonable throttle such as a few attempts per minute, and watch what legitimate clients actually need before tuning.

Use named limiters so the rules are easy to read.
Return a 429 with the `Retry-After` header.
Remember that a public contact form needs more protection than an authenticated admin route.

What this website uses

The blog and website APIs follow exactly this pattern: form requests for validation, JSON resources for output, and per-route throttles so anonymous traffic cannot flood the database.

The takeaway

Small, boring conventions beat clever abstractions. A consistent response shape, centralised validation and sensible throttling will take an API from "works for me" to "works for everyone".

Key takeaways

Define the response shape once with API resources so clients never guess whether a payload is an object or an array.
Move validation, authorisation and rules into Form Requests so they live together and can be tested in isolation.
Return the default 422 error shape, since most clients already know how to parse it.
Throttle every public write route, then tune the number from what legitimate clients actually need.
Remember a public contact form needs far more protection than an authenticated admin route.

FAQ

Q: Why move validation out of the controller into a Form Request? A: Rules inside a controller work until they stop scaling. A Form Request keeps validation, authorisation and rules next to each other, lets you test them in isolation, and keeps the rules close to the domain they describe.

Q: How do I choose a sensible rate limit for a public endpoint? A: Start with something reasonable, such as a few attempts per minute, and watch what legitimate clients actually need before tuning it. A public contact form deserves more protection than an authenticated admin route, because anonymous traffic can flood the database.