Weave Code
Rest Api Laravel Package
bagisto/rest-api
REST API for Bagisto e-commerce: exposes storefront and admin data—products, categories, carts, customers, orders, and more—via token-authenticated JSON endpoints, so Laravel developers can build headless storefronts, mobile apps, and integrations on top of Bagisto's backend.
At a glance
Frequently asked questions about Rest Api
- How do I install bagisto/rest-api in a Bagisto Laravel project?
- Install it with Composer inside a compatible Bagisto application, publish the package provider/assets as required, and run migrations. Then verify the registered endpoints with php artisan route:list --path=api. It is not a standalone Laravel package, so add it only to an existing Bagisto 2.3.x backend.
- Which Laravel and Bagisto versions does bagisto/rest-api support?
- The package tracks Bagisto core, and the assessment specifically calls out Bagisto 2.3.x compatibility. Laravel and PHP support should be confirmed against the exact Bagisto 2.3.x release and the package Composer constraints before you pin versions. A version skew may install without a clean failure and later show up as serialization or repository signature problems.
- Can I use bagisto/rest-api to build a headless storefront or mobile app?
- Yes. The package is the REST presentation layer over Bagisto catalog, customer, cart, checkout, and order data, exposing token-authenticated JSON endpoints for headless storefronts, mobile apps, kiosks, partner portals, and integrations. Each consumer must correctly implement token lifecycle, ETag caching, and the checkout state sequence.
- What authentication backs the Bagisto REST API tokens?
- The overview states that endpoints are token-authenticated, but the provided context does not confirm whether the driver is Sanctum or Passport. Before commitment, verify token expiry, revocation semantics, and how authorization headers interact with caching. That detail matters for mobile sessions and external partner integrations.
- Does bagisto/rest-api support ETag caching and conditional requests?
- Version 2.3.1 adds ETag and conditional-request support, which can reduce payload transfer for read-heavy catalog traffic and improve mobile latency. Use it carefully on personalized endpoints such as cart, checkout, customer, and orders. Confirm middleware ordering and production proxy or compression behavior, because strong ETags can be weakened or stripped.
- Is it safe to cache cart, checkout, customer, or order API responses?
- No, not with shared caching defaults. Personalized responses need deliberate Cache-Control: private, Vary: Authorization, and a documented kill switch for the ETag middleware. A shared cache serving one customer cart to another is a data-leak-grade incident, so test with two distinct tokens against the same endpoint.
- How can I verify the API routes and documentation after installation?
- Run php artisan route:list --path=api to confirm which routes are registered and live. The 2.3.1 release refreshes the Swagger documentation, which is the fastest way to inspect request and response contracts. Also confirm whether the Swagger spec is generated from annotations or hand-maintained, because that affects contract reliability.
- What are the biggest production risks with bagisto/rest-api?
- The dominant risk is version lockstep with Bagisto core; a skew can cause subtly wrong serialization or changed repository method signatures rather than a clean install failure. Other hazards include cache correctness on personalized responses, middleware ordering for ETags, proxy or compression rewriting, and default route exposure that may be broader than policy intends. The package also has a small maintainer base, so staff the API layer as first-party infrastructure.
- Can I use bagisto/rest-api on plain Laravel without Bagisto?
- No. It is the REST presentation layer over Bagisto commerce domain model and has no independent value outside Bagisto. There is no port to vanilla Laravel and no partial adoption, so a plain Laravel application should use a different package or build a custom API.
- How should I manage upgrades and long-term ownership of bagisto/rest-api?
- Use a tight Composer constraint against a tested Bagisto 2.3.x version and define an upgrade ritual that reruns route, serialization, and forced-change ETag round-trip tests. Name an internal owner for the API layer and decide whether fixes go through Composer patches or a fork. Review route exposure and the /api/v1 versioning and deprecation policy before exposing the API to external partners.
Weaver
How can I help you explore Laravel packages today?