- How do I install laravel-api-explorer and where does the UI appear?
- Install it as a dev dependency with composer require --dev netojose/laravel-api-explorer. Laravel package auto-discovery registers the service provider, so the console normally appears at /api-explorer once installed. You can publish the package config to adjust the URI and gating. Because the last release targets Laravel 5.8–6.x, verify Composer resolves on your Laravel version first.
- Which Laravel and PHP versions does laravel-api-explorer support?
- The last tagged release was December 12, 2019, which places it in the Laravel 5.8–6.x window on PHP 7.x. Modern Laravel 9, 10, and 11 have moved through PHP 8 type strictness, Blade changes, and Router contract evolution, so expect illuminate/support version conflicts and likely runtime errors. Run a compatibility spike on both your lowest and highest supported Laravel versions before committing.
- Is it safe to run laravel-api-explorer in production?
- Treat it as strictly local and dev-only. The explorer sends real authenticated requests against your application, so if its route is registered unconditionally and the config gate is misconfigured, you publish an unauthenticated console that can hit every route, including admin and destructive endpoints. Gate it behind an environment check and never enable it on staging or production.
- How do I test an API endpoint with laravel-api-explorer?
- Open the explorer UI, pick a registered route, and the form infers path and query parameters from the URI pattern. Fill in the values and fire the request against the same application instance. It is a Postman-style request runner for quick checks, not a contract test suite.
- Does laravel-api-explorer generate OpenAPI or Swagger documentation?
- No. It reads Laravel's Route::getRoutes() collection and renders forms for firing requests; it is not a documentation generator and does not emit OpenAPI or Swagger specs. If you need machine-readable specs, use Scramble for OpenAPI from code or Scribe for annotation-driven docs.
- What are good alternatives to laravel-api-explorer for documenting Laravel APIs?
- Common choices are Scribe, which generates documentation from annotations, Scramble, which generates OpenAPI from your code, or simply committing a Postman or Insomnia collection exported from php artisan route:list. Each gives you durable, versionable artifacts instead of a runtime console. For teams on modern Laravel, those tools are actively maintained.
- Why does laravel-api-explorer break on closure routes or invokable controllers?
- The package's route-action reflection relies on older Laravel internals and string parsing of route URIs. Closure routes, invokable controllers, Enum or BackedEnum parameters, and route-model-bound parameters can hit fatal errors or produce misleading forms. Test discovery against your real route table including Route::resource, Route::apiResource, and Route::fallback.
- How do I change the laravel-api-explorer URL or configuration?
- Publish the package config file and adjust the URI key; the default is typically /api-explorer. The config also controls whether the explorer is enabled, so use it to restrict the tool to local environments. The package adds no migrations or domain-level changes.
- Is laravel-api-explorer still maintained, and what license does it use?
- No release since December 2019, roughly 144 stars, and a single-maintainer signal mean it is effectively abandoned with no security-response path or upgrade path. Repository metadata reports NOASSERTION, so check the actual LICENSE file; for many corporate OSS intake gates that ambiguity is a blocker. Any fix you need, you own permanently.
- Can laravel-api-explorer handle authenticated endpoints, CSRF tokens, or file uploads?
- Parameter inference is string parsing on the route URI, so typed request bodies, nested resources, enum constraints, auth header acquisition, file uploads, and pagination semantics are manual or unsupported. If your endpoints need CSRF tokens or multi-tenant headers, the explorer may be misleading rather than helpful. Consider a committed Postman collection or Scramble for those cases.