Building Robust RESTful APIs with Laravel

Start with the shape of your responses

The fastest way to make an API pleasant to consume is a stable response shape. Laravel's API resources give you a single place to define it, so the frontend never has to guess whether a payload is an object, an array, or something in between.

Validation belongs in Form Requests

Writing rules inside the controller works, but it stops scaling. Extract them into a Form Request so that validation, authorisation and rules live next to each other and can be tested in isolation.

• Keep rules close to the domain they describe.
• Return the default 422 error shape; most clients already parse it.
• Add a couple of custom rules for the weird cases instead of piling conditions into the controller.

Rate limiting is a safety feature, not a niche

A public write endpoint is a spam magnet until you throttle it. Prefix the route with a reasonable throttle such as a few attempts per minute, and watch what legitimate clients actually need before tuning.

• Use named limiters so the rules are easy to read.
• Return a 429 with the `Retry-After` header.
• Remember that a public contact form needs more protection than an authenticated admin route.

What this website uses

The blog and website APIs follow exactly this pattern: form requests for validation, JSON resources for output, and per-route throttles so anonymous traffic cannot flood the database.

The takeaway

Small, boring conventions beat clever abstractions. A consistent response shape, centralised validation and sensible throttling will take an API from "works for me" to "works for everyone".

Key takeaways

• Define the response shape once with API resources so clients never guess whether a payload is an object or an array.
• Move validation, authorisation and rules into Form Requests so they live together and can be tested in isolation.
• Return the default 422 error shape, since most clients already know how to parse it.
• Throttle every public write route, then tune the number from what legitimate clients actually need.
• Remember a public contact form needs far more protection than an authenticated admin route.

FAQ

Q: Why move validation out of the controller into a Form Request? A: Rules inside a controller work until they stop scaling. A Form Request keeps validation, authorisation and rules next to each other, lets you test them in isolation, and keeps the rules close to the domain they describe.

Q: How do I choose a sensible rate limit for a public endpoint? A: Start with something reasonable, such as a few attempts per minute, and watch what legitimate clients actually need before tuning it. A public contact form deserves more protection than an authenticated admin route, because anonymous traffic can flood the database.