Weave Code
Filament Api Laravel Package
tomatophp/filament-api
TomatoPHP Filament API adds RESTful endpoints to Filament resources, letting you expose CRUD operations, filters, and relationships via Laravel Sanctum authentication. Generate and manage model APIs directly from your admin panel.
Filament API is a Filament plugin that exposes your admin resources as clean REST API endpoints. It helps you reuse existing Filament resource definitions to deliver CRUD APIs for Eloquent models, reducing duplicate controller code and making it easier to power mobile apps, dashboards, or external integrations.
- Generate API endpoints from Filament resources
- Built-in CRUD support for Eloquent models
- Configurable authentication and access control
- Integrates with Laravel and Filament conventions
- Publishable configuration for quick customization
Frequently asked questions about Filament Api
- How do I install tomatophp/filament-api in a Laravel app?
- Install it with Composer, run the API scaffolding step (install:api) so Sanctum is available, publish the package configuration, and run migrations. Then annotate or register the Filament resource you want to expose, and the package generates CRUD routes plus a controller for the bound Eloquent model. The install is cheap only if Filament is already your source of truth in production; if not, treat it as a platform migration rather than a package install.
- Which Laravel, PHP, and Filament versions does filament-api support?
- The package targets Laravel 10, 11, and 12, PHP 8.1+, and Filament v3 or v4, with Laravel Sanctum for API authentication. Because it introspects Filament resource internals rather than a stable public API, you should pin it alongside your Filament version in composer.json. Check the repository's composer constraints before upgrading either package.
- How does authentication work for the API endpoints generated by Filament API?
- Generated routes are intended to be protected with Laravel Sanctum, and the package ships publishable configuration for authentication and access control. Sanctum gives you token-based auth for mobile apps, dashboards, and first-party integrations. You still need to decide token abilities, rate limits, and which consumers may reach which endpoints.
- Does tomatophp/filament-api respect my Filament policies and canAccess or canViewAny rules?
- Do not assume it does. Filament policies and canAccess/canViewAny checks are panel-scoped, while generated API routes are not the panel, so assuming they fire is a security defect rather than a config gap. Add explicit authorization in the generated or hand-written controllers (Gates, policies, middleware) and cover it with tests before shipping.
- Does Filament API handle multi-tenancy correctly out of the box?
- Be careful here. Resource queries that rely on getEloquentQuery() may be scoped to the panel's current tenant, and an API request typically has no current tenant, so tenant scoping can silently disappear. Scope every generated endpoint explicitly by the authenticated user's tenant and test it with cross-tenant requests. This is the risk most likely to end a project.
- How do I generate a REST API from an existing Filament resource?
- You point the package at a Filament resource, and it reads the form schema, table definition, and model binding to emit CRUD routes and a controller that maps request input into Eloquent writes and JSON responses. That means your admin panel definition becomes the contract for the API, which works well for straightforward CRUD entities. It also means any consumer contract that diverges from the admin UI has to be hand-written.
- Can I customize the generated endpoints, responses, or add extra operations?
- You can customize through the publishable configuration, and you can always write your own controllers for endpoints the generator does not cover. Computed fields, bulk operations, workflow transitions, field-level permissions, and versioned deprecation policies are outside what the generator produces. Plan for the package to cover a subset of your API surface, not all of it.
- Is Filament API safe for a public, revenue-critical production API?
- It is a single-maintainer package with a small star count, no dependents, and no evidence of production hardening, so a public API where revenue depends on it is an unhedged bet. The recommended posture for that case is fork-and-own with a named maintainer rather than direct adoption. For internal or few-and-coordinated consumers behind an existing Filament panel, the fit is much stronger.
- Will upgrading Filament break tomatophp/filament-api?
- Likely, or at least it will require the package to support the new major first. The package depends on Filament's resource lifecycle and form/table component contracts, not just a stable public API, so a Filament major upgrade is effectively an upgrade to this package's assumptions. Pin the two as a single unit in composer.json and schedule the pairing as a migration with a window, not a patch bump.
- Does Filament API support file uploads, repeaters, RichEditor, and nested relationship fields?
- These are exactly where Filament form state converted to JSON becomes lossy, and they are the first things to leak in real use. Do not promise them in your API contract without a passing endpoint test, and hand-write those endpoints when the generated version fails. Renaming a field or swapping a form component also changes the JSON silently, so add endpoint contract tests and a resource-change checklist to your PR process.
Weaver
How can I help you explore Laravel packages today?