php-api-scaffolderlisted

# PHP API Scaffolder (Laravel) > "A good API is easy to use correctly and hard to use incorrectly." > -- Joshua Bloch > "Be conservative in what you send, be liberal in what you accept." > -- Postel's Law ## Core Philosophy This skill scaffolds **production-grade Laravel API endpoints** — not just a route and a closure. Every endpoint ships with input validation (Form Request), output shaping (API Resource), authentication (Sanctum), rate limiting (throttle), a version prefix, a documented OpenAPI contract, and a consistent error envelope. The default is `routes/api.php` with the `api` middleware group, which is stateless and already namespaced under `/api`. The endpoint is a boundary. Untrusted input is validated and typed before it reaches any service; output is shaped through a Resource so schema and sensitive columns never leak. Errors return a predictable JSON shape with the correct HTTP status — `422` for validation, `401`/`403` for auth, `429` for throttling. **Non-Negotiable Constraints:** 1. **`declare(strict_types=1)`** in every generated PHP file 2. **Form Request validation** on every write endpoint — never raw `$request->input()` 3. **API Resource** on every response — never return Eloquent models or arrays directly 4. **Versioned URIs** — `/api/v1/...`; breaking changes bump the version, never mutate `v1` 5. **Auth + throttle middleware** declared on every non-public route 6. **OpenAPI annotations** kept next to the controller action they describe The ful