PHPackages                             glueful/api-skeleton - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [HTTP & Networking](/categories/http)
4. /
5. glueful/api-skeleton

ActiveProject[HTTP & Networking](/categories/http)

glueful/api-skeleton
====================

Glueful API Application Skeleton — Create high-performance APIs

v1.49.1(4d ago)126MITPHPPHP ^8.3

Since Oct 6Pushed 1mo agoCompare

[ Source](https://github.com/glueful/api-skeleton)[ Packagist](https://packagist.org/packages/glueful/api-skeleton)[ Docs](https://glueful.com/)[ RSS](/packages/glueful-api-skeleton/feed)WikiDiscussions main Synced today

READMEChangelog (10)Dependencies (24)Versions (88)Used By (0)

Glueful API Skeleton
====================

[](#glueful-api-skeleton)

A minimal API application starter powered by the Glueful framework.

Quick Start
-----------

[](#quick-start)

```
# Install dependencies
composer install

# Initialize application (runs migrations, generates key)
php glueful install --quiet

# Start development server
php glueful serve

# Visit the API
curl http://127.0.0.1:8080/v1/welcome
curl http://127.0.0.1:8080/health
```

Default Routes
--------------

[](#default-routes)

RouteMethodDescription`/v1/welcome`GETWelcome JSON payload`/v1/status`GETLightweight status check`/health`GETFramework health endpointIdentity, Accounts & RBAC
-----------------------------

[](#identity-accounts--rbac)

The skeleton enables two extensions by default — **`glueful/users`** (identity store + account lifecycle) and **`glueful/email-notification`** (the `email` channel). Authorization (RBAC) is **opt-in**.

**1. Default skeleton — no RBAC required**

- Login / token refresh / logout via the core auth seam (backed by `glueful/users`).
- `GET /me` — the authenticated user's account + nested profile (authentication only).
- Account lifecycle (`/auth/verify-email`, `/auth/forgot-password`, `/auth/reset-password`).
- Email-PIN 2FA (`/2fa/*`, when `TWO_FACTOR_ENABLED=true`).

**2. Optional user lookup / list — needs RBAC**

These are **off by default** and **permission-gated** (`users.read`):

```
USERS_USER_LOOKUP_ENABLED=true   # GET /users/{uuid}
USERS_USER_LIST_ENABLED=true     # GET /users  (also requires the lookup flag)
```

Because they require `users.read`, they only work once an RBAC provider is enabled and the permission is granted — without one, the framework gate fails closed (`403`).

**3. Enabling RBAC (`glueful/aegis`)**

```
composer require glueful/aegis
php glueful extensions:enable aegis
php glueful migrate:run                                    # RBAC tables + seeds default roles
php glueful aegis:bootstrap-admin --user=   # syncs the catalog, grants users.read, assigns the role
```

`aegis:bootstrap-admin` is the one-command first-admin path: it syncs the declared permission catalog, creates/reuses a role (default `admin`), grants it `users.read`, and assigns that role to your user — enough to unlock the lookup/list endpoints. Useful flags:

- `--role=administrator` — target a specific (e.g. seeded) role instead of `admin`.
- `--permission=posts.read` — repeatable; grant specific permissions instead of the `users.read` default.
- `--all-catalog` — grant **every** catalog permission (full admin).
- `--dry-run` — preview without writing.

> Manual equivalent (if you prefer): `php glueful permissions:sync`, then assign a seeded role (`superuser`/`administrator`) to the user via the roles API (`POST /{user_uuid}/roles`).

> Modern-framework norm: the user store is a sensible default; full RBAC stays opt-in so a fresh skeleton boots lean and secure (fail-closed) without imposing roles/permissions setup until you need it.

Project Structure
-----------------

[](#project-structure)

```
api-skeleton/
├── app/                    # Application code
│   ├── Controllers/        # HTTP request handlers
│   ├── Models/             # ORM models
│   └── Providers/          # Service providers
├── bootstrap/app.php       # Framework initialization
├── config/                 # Configuration files
├── database/migrations/    # Database migrations
├── public/index.php        # HTTP entry point
├── routes/api.php          # API routes
├── storage/                # Runtime data (logs, cache, db)
└── tests/                  # PHPUnit tests

```

This skeleton uses a **minimal starter structure**. As your application grows, see [docs/APPLICATION\_ARCHITECTURE.md](docs/APPLICATION_ARCHITECTURE.md) for guidance on scaling to standard and enterprise structures.

Architecture Guide
------------------

[](#architecture-guide)

The skeleton follows a progressive complexity model:

Project SizeStructure**Starter** (< 10 endpoints)Controllers, Models, Providers**Standard** (10-50 endpoints)+ Actions, DTO, Events, Jobs, Policies**Enterprise** (50+ endpoints)+ Repositories, Services, Validators**Start minimal. Add complexity only when needed.**

See the full guide: [docs/APPLICATION\_ARCHITECTURE.md](docs/APPLICATION_ARCHITECTURE.md)

Controllers & Routing
-------------------------

[](#controllers--routing)

Routes are defined explicitly in `routes/api.php`:

```
// Simple version prefix (customize as needed)
$router->group(['prefix' => 'v1'], function (Router $router) {
    $router->get('/welcome', [WelcomeController::class, 'index']);
    $router->get('/status', [WelcomeController::class, 'status']);
});

// Other prefix options:
// - 'v1'                 → /v1/...
// - '/api/v1'            → /api/v1/...
// - api_prefix($context) → uses config/api.php settings
```

The framework also supports attribute-based routing:

```
#[Controller(prefix: '/api/v1')]
class UserController extends BaseController
{
    #[Get('/users/{id}')]
    public function show(int $id): Response { }
}
```

Configuration
-------------

[](#configuration)

Key configuration files in `config/`:

FilePurpose`app.php`Application settings, paths, URLs`database.php`Database connections (SQLite default)`security.php`CORS, CSRF, headers, rate limiting`api.php`API versioning, field selectionEnvironment variables in `.env` override config values.

CLI Commands
------------

[](#cli-commands)

```
# Development
php glueful serve                    # Start dev server
php glueful serve --watch            # Auto-restart on changes

# Database
php glueful migrate:run              # Run migrations
php glueful migrate:status           # Check migration status

# Code Generation
php glueful scaffold:controller UserController
php glueful scaffold:model User --migration
php glueful scaffold:request CreateUserRequest

# Utilities
php glueful generate:key             # Generate APP_KEY
php glueful cache:clear              # Clear cache
php glueful generate:openapi         # Generate API docs
```

Deploying To Production
-----------------------

[](#deploying-to-production)

Before deploying a generated app, review this checklist:

```
APP_ENV=production
APP_DEBUG=false
FORCE_HTTPS=true
```

- Generate strong secrets with `php glueful generate:key`, then set `APP_KEY` and `JWT_KEY` in the production environment.
- Move from SQLite to your production database driver and run `php glueful migrate:run` during deployment.
- Move `QUEUE_CONNECTION` away from `sync` for background work, usually to `database`, `redis`, or your queue driver.
- Move `CACHE_DRIVER` away from local file storage when the app runs on more than one server.
- Generate the production command manifest with `php glueful commands:cache`.
- Check route-cache health with `php glueful route:cache:status`; clear stale routes with `php glueful route:cache:clear`.
- Clear application cache with `php glueful cache:clear` after config or deployment changes.
- Enable PHP opcache in production and deploy with Composer's optimized autoloader.
- Point logs at `storage/logs` or your platform log sink, never under `public/`.
- Keep `/docs` disabled unless API docs should be public in that environment.

Testing
-------

[](#testing)

```
# Run all tests
composer test

# Run specific suites
composer test:unit
composer test:integration
```

Base test case at `tests/TestCase.php` provides framework integration.

Notes
-----

[](#notes)

- **Database**: SQLite at `storage/database/glueful.sqlite` (zero config)
- **Queue**: `sync` driver for immediate execution (change to `redis` or `database` in `.env`)
- **Docs**: API documentation at `/docs` when `API_DOCS_ENABLED=true`

###  Health Score

48

—

FairBetter than 93% of packages

Maintenance96

Actively maintained with recent releases

Popularity11

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity66

Established project with proven stability

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~3 days

Total

86

Last Release

4d ago

PHP version history (2 changes)v1.0.0PHP ^8.2

v1.5.0PHP ^8.3

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/95650726?v=4)[msowah](/maintainers/msowah)[@msowah](https://github.com/msowah)

---

Top Contributors

[![MichaelSowah](https://avatars.githubusercontent.com/u/24699905?v=4)](https://github.com/MichaelSowah "MichaelSowah (118 commits)")

---

Tags

phpapirestSkeletonglueful

###  Code Quality

TestsPHPUnit

Code StylePHP\_CodeSniffer

### Embed Badge

![Health badge](/badges/glueful-api-skeleton/health.svg)

```
[![Health](https://phpackages.com/badges/glueful-api-skeleton/health.svg)](https://phpackages.com/packages/glueful-api-skeleton)
```

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)