Laravel Api Explorer Laravel Package

Getting Started

Install the package with Composer and let Laravel's package discovery register the service provider:

composer require netojose/laravel-api-explorer

Publish the config so you can gate and scope it:

php artisan vendor:publish --provider="NetoJose\LaravelApiExplorer\LaravelApiExplorerServiceProvider" --tag=config

This drops config/api-explorer.php into your app. Read that file first — it is the single source of truth for the explorer's path, middleware, and route visibility rules.

Start the dev server and hit the explorer (default path is /api-explorer):

php artisan serve
# open http://localhost:8000/api-explorer

Your first useful use case: let the explorer introspect your routes/api.php and routes/web.php, pick a simple GET endpoint, fill in any route parameters, and hit Send. The panel builds the request from the registered route definition — URI, method, controller/action — so it is a live mirror of what Laravel actually has loaded, not a hand-maintained doc file.

Implementation Patterns

Environment-gated internal tool. The most common production pattern is to leave the explorer enabled only locally/staging via the config's enabled flag (typically an API_EXPLORER_ENABLED env var) and lock it behind your normal auth middleware. Treat it as a developer toolbar, not a customer-facing API console.

Scope it to the API you're documenting. Use the only/except config (or equivalent route filtering) to hide admin, health-check, and debug routes. For versioned APIs, filter by URI prefix (e.g. api/v1/*) so the list stays readable and you don't accidentally surface internal endpoints.

Auth-aware configuration. Because the explorer issues real HTTP requests from the browser, the panel's own middleware and the target endpoint's middleware must agree. For token-based APIs, set the panel under web middleware and paste the bearer token into the request headers field per call. For session-authenticated apps, log into the app in the same browser session and the explorer's requests will reuse the cookie.

Smoke-testing workflow. Use it as a fast loop while building an endpoint: register the route, refresh the explorer, send a POST with a JSON body, inspect status code and raw response. It complements, not replaces, proper feature tests — nothing here is assertable or repeatable in CI.

Documentation-by-introspection. Because the route list is derived from Route::getRoutes(), route names, prefixes, and middleware strings are always current. Use descriptive route names (users.orders.index) rather than relying on the explorer to explain intent — the package shows the signature, not the semantics.

Pair with php artisan route:list. The explorer is a prettier, interactive view of the same data. When something looks wrong in the UI, drop to route:list --json to confirm the route truly exists and check its middleware stack; that isolates package bugs from routing bugs quickly.

Gotchas and Tips

Age is the biggest constraint. Last release was December 2019, targeting Laravel 5.5–6.x. On Laravel 8+, PHP 8, or anything using modern typed properties and union types, expect fatal errors or silent breakage. Pin it to a legacy service, or fork and patch the service provider/controller. Verify composer why-not before assuming compatibility.

Route caching hides things. If php artisan route:cache has been run, dynamically registered or closure-based routes may behave differently. Clear with php artisan route:clear when the explorer's list looks stale.

CSRF will bite you on POST/PUT/DELETE. If the panel sits under web middleware and your target routes are also web, requests made from the explorer UI will fail with 419 unless the CSRF token is available or the explorer path is excluded. The usual fix is to put the explorer under a dedicated middleware group that omits VerifyCsrfToken, or target api-group routes.

Redirects from auth middleware break the JSON view. If an endpoint's auth middleware redirects to a login page, the explorer shows an HTML redirect rather than an auth error. Prefer explicit Authorization headers over session middleware when documenting APIs.

Route model binding is not resolved for you. Parameters like {order} are just strings in the URL builder. The package cannot know valid IDs, so you must supply realistic values manually — and there is no schema inference from FormRequests or validation rules, so document request bodies separately.

No OpenAPI/Swagger export. This is a runtime explorer, not a spec generator. There is no machine-readable output to feed into client SDK generators or Postman. Plan for a second tool (or a maintained openapi.json) if external consumers need docs.

Security defaults deserve scrutiny. Given the package's age and the "NOASSERTION" license metadata, audit the service provider before deploying anywhere reachable. The safest posture: bind it to local only, disable via env in every other environment, and never expose it on a public hostname.

Extension points are thin. You can publish/override the views and tune the config, but there is no event system or driver interface. If you need custom rendering or filtering beyond the config keys, you are editing the package's Blade templates — keep those overrides under version control and expect merge pain.

Debugging checklist. Confirm the provider registered (php artisan about or route:list | grep api-explorer), confirm the config is published and the enabled flag is true for your environment, confirm the middleware stack doesn't redirect unauthenticated requests, and check storage/logs/laravel.log for exceptions thrown by the explorer controller itself.