REST (Representational State Transfer) is an architectural style for designing networked applications using stateless, resource-based communication over HTTP.

An API is 'RESTful' when it follows these conventions consistently, using proper HTTP methods and status codes rather than custom action-based endpoints.

Route::get('/api/users', [UserController::class, 'index']);
Route::post('/api/users', [UserController::class, 'store']);
Route::put('/api/users/{id}', [UserController::class, 'update']);
Route::delete('/api/users/{id}', [UserController::class, 'destroy']);

Idempotent means calling the method multiple times produces the same result as calling it once - important for retry logic on unreliable networks.

return response()->json(['error' => 'User not found'], 404);

Token-based authentication issues a token on login that the client sends with every subsequent request, avoiding the need for server-side session state.

// Login - issue token
Route::post('/login', function (Request $request) {
    $user = User::where('email', $request->email)->first();
    if (!$user || !Hash::check($request->password, $user->password)) {
        return response()->json(['message' => 'Invalid credentials'], 401);
    }
    $token = $user->createToken('api-token')->plainTextToken;
    return response()->json(['token' => $token]);
});

// Protecting routes
Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
    return $request->user();
});

Versioning lets you evolve an API without breaking existing clients that depend on the current behavior.

Route::prefix('v1')->group(function () {
    Route::apiResource('users', UserV1Controller::class);
});
Route::prefix('v2')->group(function () {
    Route::apiResource('users', UserV2Controller::class);
});

URI versioning is the most common approach because it's explicit and easy for consumers to understand at a glance.

Pagination limits how many records are returned per request, improving performance and response size for large datasets.

public function index(Request $request)
{
    $perPage = $request->get('per_page', 15);
    $users = User::paginate($perPage);
    return response()->json($users);
}

// Response includes:
// data, current_page, last_page, per_page, total, next_page_url, prev_page_url

Validation ensures incoming data meets expected rules before it's processed, returning clear errors otherwise.

public function store(Request $request)
{
    $validated = $request->validate([
        'name' => 'required|string|max:255',
        'email' => 'required|email|unique:users,email',
        'age' => 'nullable|integer|min:18',
    ]);
    $user = User::create($validated);
    return response()->json($user, 201);
}

// On failure, Laravel automatically returns:
// 422 Unprocessable Entity with { "errors": { "email": ["..."] } }

Using Form Request classes (php artisan make:request) keeps validation logic out of controllers for larger applications.

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that blocks JavaScript from making requests to a different domain unless the server explicitly allows it via response headers.

header('Access-Control-Allow-Origin: https://myfrontend.com');
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(204);
    exit;
}

In Laravel, this is typically handled via the built-in cors middleware and config/cors.php rather than manual headers.

Rate limiting restricts how many requests a client can make in a given time window, protecting the API from abuse and overload.

// Laravel built-in throttle middleware
Route::middleware('throttle:60,1')->group(function () {
    Route::get('/api/data', [DataController::class, 'index']);
});
// Allows 60 requests per 1 minute per user/IP

When the limit is exceeded, the API should return 429 Too Many Requests.

A consistent response structure makes an API predictable and easier for consumers to parse, regardless of success or failure.

// Success response
{
  "success": true,
  "data": { "id": 1, "name": "John" },
  "meta": { "page": 1, "total": 50 }
}

// Error response
{
  "success": false,
  "message": "Validation failed",
  "errors": { "email": ["The email field is required."] }
}