sunchayn/nimbus
Nimbus is an in-browser API client for Laravel that auto-discovers your routes and validation rules, giving you an interactive playground to test endpoints. Features auth injection, cookie decryption, payload autofill, and transaction rollback for safe destructive requests.
Install (3 commands):
composer require sunchayn/nimbus
php artisan vendor:publish --tag=nimbus-assets --tag=nimbus-config
# then visit http://your-app.test/nimbus
That's genuinely the whole onboarding path — Nimbus does not require you to annotate routes or write any config to get first value. Route discovery is static-analysis based, so the first time you open /nimbus you should already see your API endpoints grouped in the sidebar.
Where to look first:
config/nimbus.php — this is the only file that matters for tuning. It controls which routes are scanned, how applications are defined, and (since 0.4.0) the multi-application map. Read it before you touch anything else; most "why isn't my route showing up" questions are answered here.wiki/user-guide/README.md) rather than the README — the README is a pitch, the wiki is the manual. With 0 dependents and an alpha release, the wiki is effectively the only reliable answer source.Your first use case: pick a POST endpoint backed by a FormRequest. Click it, hit the payload autofill button, and send. The two things that will sell you on the package happen here: the request body is pre-shaped from your actual validation rules (required, string, email, max:255 all become typed inputs), and the inline value generators let you drop in a UUID or a unique email without leaving the input field. Then switch the auth selector to "current session" and re-send — you're now testing the authenticated path with zero token plumbing.
The core loop: schema → autofill → tweak → send → inspect. The package rewards you for keeping validation rules accurate, because the request builder is only as good as your FormRequest. Teams that get the most out of Nimbus treat validation rules as the single source of truth for the API contract and stop hand-maintaining Postman collections entirely.
Auth mode selection is per-request, and that's the right mental model. The four modes map onto distinct day-to-day jobs:
auth middleware where you're logged in as yourself.Use transaction mode for anything destructive. DELETE and PUT/PATCH requests can be wrapped in a DB transaction that rolls back on completion. This is what makes Nimbus viable against a seeded local database rather than something you're afraid to point at real data. Make it a habit: destructive method → toggle transaction mode on before the first send, not after you've already nuked a row.
dd() interception changes how you debug. Native dd() calls inside controllers and form requests render in a dedicated paginated debug viewer, in-place, without destroying the response state or requiring a page refresh. The practical pattern: leave dd() calls in your code while iterating on a handler, send the request from Nimbus, read the dump in the viewer, remove the dd(), send again — no browser refresh, no lost request body. This is the single biggest iteration-speed win in the package.
Multi-application config for split APIs. If you have a REST API and an admin API (or separate services), the 0.4.0 config shape lets you define both and toggle between them in one dashboard. Define each application with its own route prefix/matching rules so the sidebar isn't a flat 400-route dump.
Merge OpenAPI specs for endpoints you don't own. Nimbus can consume YAML/JSON specs and merge them with its internally detected routes. Reach for this when testing against an external or third-party service, or when a route's schema is too dynamic for static analysis — document it in a spec, point Nimbus at the file, and the request builder gets a usable shape.
Shareable links and saved contexts for handoffs. Capture a request state (headers, body, auth) and share the link with a colleague when filing a bug or pairing. Combined with the persistent history viewer and rewind, this replaces the "here's a curl command in Slack" ritual. Note the changelog fix in 0.4.0 for GET-with-body and JSON wrapping in curl export — if you're exporting to curl, you want ≥0.4.0.
Tabs are a workflow, not a nicety. Since 0.4.0 you can keep a create-then-fetch-then-update sequence open side by side. The natural pattern: three tabs for the CRUD triplet on the same resource, each with autofilled-but-adjusted payloads, so you can re-send the GET after every mutation without losing your place.
Value generators to satisfy unique rules. email, uuid, name, and timestamp generators exist precisely because re-sending the same autofilled payload will trip unique: validation. When you're looping requests to build test fixtures, regenerate the unique fields each time rather than editing by hand.
Single-threaded servers will make you think it's broken. php artisan serve and Laravel Sail run one request at a time, and Nimbus's relay pattern issues concurrent requests — you get timeouts and hangs that look like package bugs. Follow the documented workaround in the user guide, or just use Herd/Valet/Octane while working with Nimbus. This is the #1 false alarm.
Alpha means pin and expect churn. It's 0.x-alpha with a date-stamped release cadence. Pin the version in composer.json and read the changelog on every bump — 0.4.0's multi-application support was an explicit [breaking] config change, so an unread upgrade can silently empty your route list. Re-publish assets after upgrading (--force) or you'll be running stale frontend code against a new backend.
Lock it down, seriously. User impersonation by arbitrary ID is exactly as dangerous as it sounds, and the README says development-only twice. Do not rely on "we just won't deploy it" — add an environment guard (abort_unless(app()->environment('local'), 404)) or restrict the route in a service provider. A package that lets anyone become any user should not be reachable from a staging URL someone shares.
Schema generation is heuristic, not authoritative. Expect gaps with: Rule::when() and other conditional rules, required_if/required_with cross-field dependencies, array.* wildcards, custom Rule objects, and anything computed at runtime. The builder won't show you a field it can't statically infer — it won't warn you either. When a field is missing from the request body, just switch to raw JSON mode and write it manually; don't fight the analyzer.
Transaction rollback only covers the database. It will not undo writes to filesystem storage, cache, queued jobs, dispatched events, or outbound HTTP calls to third parties. A "rolled back" invite endpoint can still have sent the email. Use transaction mode for DB safety, and keep those other side effects in mind before firing at anything with real credentials.
Middleware can make impersonation lie to you. Multi-tenant middleware, global scopes, EnsureFrontendRequestsAreStateful, and anything keyed off the session will interact with the injected auth in ways that don't match the real request path. If impersonated results look wrong, test the same endpoint with a real login first to isolate whether it's your middleware or the impersonation mode.
403s masquerade as bugs. If a route has a FormRequest with a failing authorize(), you'll get a 403 with no schema and assume the analyzer failed. Impersonate a user with the right permissions and retry before you go digging into config.
Config and route caching erase your work. php artisan route:cache plus Nimbus's static route analysis is a bad combination — always config:clear after editing config/nimbus.php, and be aware route caching can hide routes from discovery.
dd() interception only works through the relay. Dumps inside queued jobs, queued listeners, or anything running in a separate process won't appear in the debug viewer. It's a synchronous-request tool only.
Extension points are thin by design. There's no documented plugin API for custom schema sources — your levers are (a) accurate validation rules, (b) a hand-written OpenAPI spec for the cases static analysis can't handle, and (c) the config's route/application filtering. Contribute upstream rather than forking; the maintainer is actively shipping (0.4.x → 0.5.0 in short order) and issues/discussions are the supported channel.
Use search before you scroll. 0.5.0 added search by route name and OpenAPI Operation ID, and warnings for requests still containing unresolved placeholders. If a send fails with an obviously malformed URL, check for a leftover {param} placeholder before assuming anything else.
How can I help you explore Laravel packages today?