Weave Code
Tomato Api Laravel Package
tomatophp/tomato-api
A Laravel package from the TomatoPHP ecosystem that helps you build and manage RESTful APIs, providing ready-made endpoints and scaffolding to speed up backend development and integrate your TomatoPHP apps.
tomato-api is a Laravel package that adds a ready-made REST API layer to the TomatoPHP ecosystem. It exposes your resources—and optional Filament-powered panels—through clean JSON endpoints, letting you build mobile apps, SPAs, or third-party integrations without re-implementing controllers by hand.
- Token-based authentication via Laravel Sanctum
- Auto-generated CRUD endpoints for your models
- Consistent, resource-based JSON responses
- Ready-to-use routes and controllers you can extend
- Simple config publishing for prefixes and middleware
Frequently asked questions about Tomato Api
- What is tomatophp/tomato-api used for?
- tomatophp/tomato-api is a Laravel package from the TomatoPHP ecosystem that adds a ready-made REST API layer to your application. It provides token-based authentication through Laravel Sanctum, auto-generated CRUD endpoints for your models, consistent resource-based JSON responses, and extendable routes and controllers. It also ships publishable configuration for API prefixes and middleware. Treat it as a code generator rather than a runtime dependency, because the generated code and stubs are the durable artifacts that survive removing the package.
- How do I install tomatophp/tomato-api?
- Run composer require tomatophp/tomato-api, then publish the package config and stubs and run its generator commands to scaffold controllers, form requests, API resources, and repositories. Before installing, do a dry-run install to review the full dependency tree, since TomatoPHP packages often pull in sibling packages such as an admin panel or roles and permissions. The last release was March 2023, so confirm the illuminate/* constraints resolve against your Laravel version before committing.
- Which Laravel versions does tomato-api support?
- The final release on 2023-03-31 places the illuminate/* constraints in the Laravel 9 to 10 band, and there is no visible evidence of Laravel 11 or 12 support. Run composer why-not laravel/framework "^11.0" plus a --dry-run install to confirm resolution in minutes. If the constraints do not resolve, everything after that is a fork exercise rather than a normal installation decision.
- Does tomato-api handle API authentication?
- Yes, authentication is token-based via Laravel Sanctum, so your user model needs the HasApiTokens trait and the Sanctum migrations must be in place. Authentication is not authorization, though: generated endpoints may verify a request is authenticated without checking ownership or tenant scope. Plan to add policies and scoped queries on top of the generated controllers.
- Can tomato-api expose Filament panels through JSON endpoints?
- Yes, the package can expose your resources and optional Filament-powered panels through clean JSON endpoints, which suits mobile apps, SPAs, or third-party integrations. Confirm in the dry run whether enabling that path pulls in other TomatoPHP packages, because adopting an ecosystem's auth and routing conventions is a materially larger commitment than the package description implies.
- How do I configure route prefixes and middleware in tomato-api?
- Configuration is publishable and covers the API route prefix and the middleware stack applied to generated endpoints, so you can align them with existing conventions like auth:sanctum or tenant middleware. Review the published config together with your route files, because versioned prefixes and middleware are the parts of the architecture that outlive the vendor relationship.
- Can I customize or override the generated controllers and stubs?
- Generated code belongs to your application, and whether the stubs are publishable is the single fact that determines if the package is a forkable asset or a dead end. If stubs can be overridden, the generator can emit house-conventional code; if not, lift the templates in-house and drop the dependency. Re-running the generator overwrites hand edits, so choose either generate-once-then-hand-maintain or template-first and state it in the decision record.
- Does tomato-api generate a repository pattern, and do I need one?
- The package generates a repository interface plus an Eloquent implementation, along with controllers, form requests, and API resources. That pays off only where the repository pattern is already house style; where it is not, the generated indirection is a permanent tax with no offsetting benefit. This is an architecture-standard decision owned by a tech lead, not a side effect of an evaluation spike.
- Are the generated CRUD endpoints secure by default?
- Not automatically. Scaffolding tools emit stubs' defaults, and stubs' defaults are not policies: index and show can leak records across tenants, and update or destroy may check authentication but not ownership. Generated controllers also typically pass $request->validated() straight through, so if rules() leaks is_admin or tenant_id a client can set it. Review each rules() method field by field and add policies and tenant-scoped queries for the first several resources.
- Is tomato-api still maintained, and what are the alternatives?
- There has been no release since March 2023, along with zero stars, zero dependents, and no visible security-response process, so operationally 'we use this package' is identical to 'we maintain a fork of it'. It is a plausible fit for internal or back-office APIs where generated CRUD is the bulk of the work and a named owner maintains the generated code and templates, and a poor fit for customer-facing or regulated APIs that need an API product layer this package does not provide. Alternatives include writing conventional Laravel controllers and API resources by hand, or using Laravel's own scaffolding plus Sanctum, both of which keep the architecture commitment inside your codebase.
Weaver
How can I help you explore Laravel packages today?