API: Introduction & Installation

seviaflow/api is the optional headless REST and OpenAPI adapter. It depends on seviaflow/core and does not require seviaflow/ui. The package is free and has no licensing dependency.

Install

composer require seviaflow/api:^0.1@dev
php artisan vendor:publish --tag=seviaflow-api-config

Defaults

First authenticated request

Start in a Laravel 12 or 13 application with its database configured. The steps below create a minimal headless Customer Resource; the full Customer Resource example adds UI features. Run the Composer command below to install the package, then complete the Laravel API setup.

composer require seviaflow/api:^0.1@dev
php artisan install:api
php artisan vendor:publish --tag=seviaflow-config
php artisan vendor:publish --tag=seviaflow-api-config
php artisan make:model Customer -m
php artisan make:migration add_is_admin_to_users_table --table=users

In the generated Customer migration, add $table->string('name'); alongside its generated ID and timestamps. In the new users migration, add $table->boolean('is_admin')->default(false); inside Schema::table('users', ...), and drop that column in its down method. Run php artisan migrate after editing both migrations.

Add Laravel\Sanctum\HasApiTokens to your existing User model. Register 'customers' => CustomerResource::class in config/seviaflow.php. Create app/SeviaFlow/Resources/CustomerResource.php with this read-only definition:

<?php

namespace App\SeviaFlow\Resources;

use App\Models\Customer;
use SeviaFlow\Core\Resources\ApiResource;
use SeviaFlow\Core\Resources\Resource;

final class CustomerResource extends Resource
{
    protected static string $model = Customer::class;

    public static function api(ApiResource $api): ApiResource
    {
        return $api->enabled()->readable(['id', 'name']);
    }
}

Assign is_admin only through your trusted account administration process. Create app/Policies/CustomerPolicy.php in the App\Policies namespace and register it in AppServiceProvider's boot method using \Illuminate\Support\Facades\Gate::policy(\App\Models\Customer::class, \App\Policies\CustomerPolicy::class). Its read methods are:

public function viewAny(User $user): bool
{
    return (bool) $user->is_admin;
}

public function view(User $user, Customer $customer): bool
{
    return (bool) $user->is_admin;
}

Import App\Models\User and App\Models\Customer in the policy. Put both methods inside final class CustomerPolicy. Adapt the policy to your actual tenant and record scope before deployment. The policy is enforced independently of whether SeviaFlow role permissions are enabled.

In local php artisan tinker, create an operator and sample record, then issue a short-lived token:

$operator = App\Models\User::factory()->create(['email' => 'operator@example.test']);
$operator->forceFill(['is_admin' => true])->save();
$customer = new App\Models\Customer;
$customer->name = 'Example customer';
$customer->save();
$token = $operator->createToken('local-api', ['*'], now()->addHour())->plainTextToken;

The factory account is for local development only. Create a second local user without is_admin to check the denied case. Keep the token in a private local environment variable SEVIAFLOW_API_TOKEN. Start the application, then send:

curl --fail-with-body http://127.0.0.1:8000/api/admin/resources/customers \
  -H "Accept: application/json" \
  -H "Authorization: Bearer ${SEVIAFLOW_API_TOKEN}"

Expect HTTP 200 with the readable fields only. Omitting the token returns 401; a valid regular-user token returns 403 through the policy. Revoke the demo token through $operator->tokens()->where('name', 'local-api')->delete(); it then returns 401. The API test suite checks these cases with real Sanctum bearer tokens and no licensing adapter. See the Sanctum documentation for session authentication and token management.