- What is radebatz/openapi-verifier used for in Laravel?
- It is a Laravel package for checking real API responses against an OpenAPI specification. You use it in HTTP tests to assert that TestResponse JSON matches the published schema, so contract drift shows up in PHPUnit or Pest rather than production. It complements request validation and documentation generators; it does not replace them.
- How do I install radebatz/openapi-verifier in a Laravel project?
- Install it with Composer and keep an OpenAPI 3.0.x document in your repository. You also need a PSR-7/PSR-17 implementation because the package wraps league/openapi-psr7-validator. Then add response assertions to your existing HTTP tests and run them in CI.
- Does it work with PHPUnit and Pest?
- Yes, the intended integration is the Laravel HTTP test layer, so assertions run inside normal PHPUnit or Pest test runs. You verify TestResponse output against the spec as part of your existing suite. That makes spec compliance part of CI without adding a separate tool.
- Which OpenAPI versions does it support?
- The package targets OpenAPI 3.0.x specifications through the underlying league/openapi-psr7-validator. OpenAPI 3.1 and JSON Schema 2020-12 are a known gap in that validator, so 3.1 docs are a blocker rather than a minor limitation. Confirm your spec version before adoption.
- Can it validate a YAML OpenAPI specification?
- Yes, YAML specs are supported in 2.2.3 via a suggested symfony/yaml dependency. If you supply YAML without that dependency, the package gives a clear error message. Add symfony/yaml if your spec is not JSON.
- Does it validate requests as well as responses?
- The main Laravel value is response assertion: checking that what your endpoints return matches the OpenAPI schema. The TPM assessment treats request validation as a separate question, so do not assume full request validation from the Laravel adapter. If you need request checks, verify the underlying validator capabilities or use Laravel request validation alongside it.
- Should I use it as production middleware to guard API traffic?
- No, its highest-value placement is the HTTP test layer, not production traffic. The PSR-15 middleware and Guzzle/PSR-18 decorators are secondary modes for consumer-side checks in integration tests. Runtime middleware semantics also depend on your error handler, and a swallowed exception can produce silent non-verification.
- What Laravel and PHP versions are supported?
- The technical evaluation lists Laravel 10–12 on PHP 8.1+ as the stack fit, with PHPUnit or Pest and a PSR-7 implementation. Because TestResponse internals have changed across Laravel 9 to 12, verify compatibility with your exact Laravel major before pinning it in CI. A single-maintainer package may lag new framework releases.
- How does it compare with Scramble or Laravel's request validation?
- It is a conformance checker, not a documentation generator or a replacement for Laravel validation. Scramble and similar tools help produce or expose docs, while this package checks real responses against an existing OpenAPI document. Use Laravel validation for incoming request rules and this package to catch drift between the published contract and actual JSON responses.
- What are the maintenance risks and alternatives?
- The assessment flags a bus factor of one, single-digit stars, and no evidence of production use at scale, so treat it as unproven but cheap to adopt and abandon. Version 2.x is in maintenance, and OpenAPI 3.1 support is expected in a future major. If upstream goes quiet, you can call league/openapi-psr7-validator directly or write a small Laravel trait because the adapter is thin.