Web Development · WDC-52

RESTful API with Laravel

RESTful API with Laravel is a course in designing and building RESTful APIs with Laravel 13, covering resource controllers, validation, API resources and pagination, securing the API with Sanctum, CORS and rate limiting, and using Passport when OAuth2 is needed. It suits developers with some PHP, MySQL and Laravel experience, and you leave with a working marketplace API.

Updated 9 Oct 2026

From 7,200 THB / person 8,000 −10% excl. VAT 7% · group rates available

Corporate training quote Join the waiting list

PDFDownload the course outline

Duration24 hours · 4 days
FormatOnsite / live online
Next roundOn request
CertificateIncluded

Course overview

RESTful APIs are the main way mobile apps, single-page web apps and other systems talk to a back end. A good API needs careful thought about endpoint structure, JSON format, validation, error handling, security and testing. Laravel provides tools for all of this, and the current release, Laravel 13 on PHP 8.5, includes Sanctum for token authentication and built-in JSON:API resources.

This course builds the RESTful API of a marketplace with Laravel 13, from models, relationships, migrations and seeders to CRUD through resource controllers, consistent JSON and error responses, sorting, filtering and pagination. Learners protect the API with Sanctum, configure CORS and rate limiting, use Passport where OAuth2 is genuinely needed, write tests and API documentation, and finish with a workshop and deployment. (4 days, 6 hours per day, 24 hours in total, Intermediate level.)

What you’ll gain

Design RESTful APIs with consistent endpoints, status codes and JSON formats
Build models, relationships, migrations, factories and seeders for an API with Laravel 13
Write CRUD endpoints with resource controllers, form requests and Eloquent API resources
Handle errors, sorting, filtering and pagination in a systematic way
Protect the API with Laravel Sanctum, policies, CORS and rate limiting
Understand when to use Passport and OAuth2 instead of Sanctum
Write feature tests and API documentation, and deploy the API to production

Who this course is for

Developers who want to design and build RESTful APIs with Laravel
Back-end developers building APIs for mobile apps or single-page web apps
Students, teachers and lecturers interested in API development
IT staff and system administrators who connect systems through APIs

Prerequisites

Able to write PHP and use MySQL, with an understanding of classes and objects
Some experience of Laravel, such as routes, controllers and Eloquent
Basic knowledge of website design and working with databases
A laptop that can run Laravel Herd or PHP 8.3 or later, Composer, VS Code and Postman, with permission to install software

Curriculum

Course Details

This course is the 2026 edition of RESTful API with Laravel. It runs for 4 days, 6 hours per day (24 hours in total, 09:00-16:00), as lectures with labs and a workshop. Intermediate level. This edition moves from Laravel 5.7 to Laravel 13 on PHP 8.5. It enables the API with install:api, handles errors in bootstrap/app.php and uses Sanctum as the main authentication method. Passport is taught only for cases that genuinely

need OAuth2, using client credentials and the authorization code grant with PKCE instead of the password and implicit grants, which are no longer recommended. Policies, feature tests, OpenAPI documentation, queues and deployment are new. The marketplace project with buyers, sellers, products, categories and transactions is kept. The course focuses on APIs, unlike Basic Laravel for Beginners, which focuses on Blade web applications. Learners take home a lab guide, source code for every lab and a Postman collection.

Day 1 REST Principles and the Data Model

Section 1: RESTful API Principles

REST, resources, HTTP methods and statelessness
Common HTTP status codes and headers for APIs
Endpoint design, naming and versioning
Consistent JSON formats for results and errors

Section 2: Lab: Tools and a Laravel 13 Project

Install Laravel Herd (PHP 8.5 and Composer), MySQL, VS Code and Postman
Create a project and enable the API with php artisan install:api
Laravel Sail on Docker as an alternative
The Laravel extension for VS Code, and Laravel Pint

Section 3: The Laravel Structure for APIs

Project structure, the .env file and bootstrap/app.php
routes/api.php, route groups and prefixes
Artisan commands to create models, controllers and requests
Lab: a first endpoint that returns JSON

Section 4: Lab: Models, Migrations and Relationships

Design the marketplace: User, Buyer, Seller, Category, Product and Transaction
Migrations and a pivot table between products and categories
hasMany, belongsTo and belongsToMany relationships
Factories and seeders for test data

Day 2 CRUD, Validation and API Resources

Section 5: Lab: Resource Controllers and CRUD

Route::apiResource and controllers generated with --api
index, show, store, update and destroy for users
Route model binding and global scopes for buyers and sellers
Soft deletes for every model

Section 6: Validation and Error Handling

Form requests for validation
Automatic 422 errors as JSON
Handle exceptions in bootstrap/app.php with withExceptions
Lab: consistent error messages for 404, 403 and 500

Section 7: Eloquent API Resources

Shape data with API resources and resource collections
Hide internal fields and rename fields safely
Conditional relationship loading and avoiding N+1 queries
JSON:API resources in Laravel 13

Section 8: Lab: Complex Operations Across Models

Nested resources such as a seller's products and a buyer's purchases
Purchases that reduce stock inside a database transaction
Upload product images with Storage
Check edit rights with policies

Day 3 Querying Data and API Security

Section 9: Lab: Sorting, Filtering and Pagination

Paginate with paginate() and cursor pagination
Sort and filter data from query parameters
Safe multi-condition search
Cache frequently requested results

Section 10: Lab: Authentication with Laravel Sanctum

Install Sanctum through install:api and the HasApiTokens trait
Sign-up, login and logout endpoints with API tokens
Protect routes with the auth:sanctum middleware
Token abilities and token expiry

Section 11: SPAs, CORS and Rate Limiting

Sanctum for SPAs with cookies and CSRF
Configure CORS in config/cors.php
Limit requests with RateLimiter::for and throttle
Account verification email with notifications

Section 12: Laravel Passport When OAuth2 Is Needed

How to choose between Passport and Sanctum
Install with php artisan install:api --passport
The client credentials grant for system-to-system access
The authorization code grant with PKCE, and refresh tokens

Day 4 Tests, Documentation and Workshop

Section 13: Lab: Automated API Testing

Feature tests with Pest or PHPUnit
Test authenticated endpoints with Sanctum::actingAs
Factories and RefreshDatabase for test data
Run the tests before every deployment

Section 14: API Documentation and Consumption

Document the API with the OpenAPI standard
Collections and environments in Postman
Call the API from JavaScript with the Fetch API
Versioning and retiring endpoints gracefully

Section 15: Queues, Events and Performance

Send email and heavy work through queues
Events and listeners when a sale happens
Inspect queries and N+1 problems during development
Lab: notify sellers about new orders

Section 16: Workshop: The Marketplace API, Deployed

Combine every endpoint with authentication and authorisation
Production settings with config:cache and route:cache
An API security checklist before going live
Use an AI assistant to review code with care, and next steps

Schedule & training options

For individuals — public rounds

No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770

Join the waiting list Ask about rounds

For organisations — in-house / private

Tailor the content to your team’s tools and projects
Your dates, at your office or live online
Quotation with tax ID for procurement

Corporate training quote

Instructors

Samit KoyomFounder & CEO, IT Genius Engineering

Frequently asked questions

What is a RESTful API, and how should endpoints be designed?

A RESTful API treats data as resources, each with its own URL such as /products, and uses the HTTP method to say what to do: GET reads, POST creates, PUT or PATCH updates and DELETE removes. Responses are JSON with meaningful status codes such as 200, 201, 404 and 422. In Laravel, Route::apiResource creates the full set of endpoints for a controller in one line.

How do Laravel Sanctum and Laravel Passport differ, and which should I choose?

Sanctum is lightweight and needs little setup. It issues simple API tokens with abilities and expiry, or uses session cookies for SPAs, and suits your own mobile apps. Passport is a full OAuth2 server supporting client credentials and the authorization code grant with PKCE, for when external apps or services must request access to your API. The Laravel documentation recommends Passport only when you truly need OAuth2, and Sanctum otherwise.

What is CORS, and why is my API blocked when called from JavaScript?

CORS (Cross-Origin Resource Sharing) is a browser mechanism that stops JavaScript on one origin from reading API responses from a different domain, port or protocol unless the server allows it with headers such as Access-Control-Allow-Origin. Laravel has a built-in HandleCors middleware, and you set the paths, allowed origins and methods in config/cors.php.

Who is the RESTful API with Laravel course for, and what should I know beforehand?

It suits developers who want to design and build RESTful APIs with Laravel, back-end developers building APIs for mobile apps or SPAs, students, teachers and lecturers, and IT staff who connect systems through APIs. You should be able to write PHP and use MySQL, have some Laravel experience such as routes, controllers and Eloquent, and know the basics of working with databases.

What will I be able to do after the RESTful API with Laravel course?

You will be able to build a marketplace RESTful API with Laravel 13, from models, relationships, migrations, factories and seeders to CRUD through resource controllers, validation with form requests, consistent JSON and error formats, sorting, filtering and pagination. You will protect it with Sanctum, policies, CORS and rate limiting, use Passport when OAuth2 is needed, and write tests, documentation and a deployment. Participants receive a Certificate of Completion with its own number that can be verified online.

What software is used on the RESTful API with Laravel course?

You use Laravel Herd for PHP 8.5 and Composer, a MySQL or MariaDB database, VS Code with the Laravel and PHP extensions, Git, and Postman with Pest or PHPUnit for testing the API. These are installed together at the start of the course. Laravel Sail on Docker is an alternative, and Mailpit is used to test email during the course.

Articles are published in Thai.