Skip to main content
An Apivalk endpoint is always the same three classes:
  1. A controller that extends AbstractApivalkController.
  2. A request class that extends AbstractApivalkRequest.
  3. One or more response classes that extend AbstractApivalkResponse.
For a public endpoint you skip RouteAuthorization entirely — the SecurityMiddleware treats the route as open.

Directory layout

If you set up auto-discovery on src/Http/Controller, no registration step is needed — the controller is picked up by ClassLocator.

1. The request

Nothing to validate; just satisfy the interface:

2. The response

3. The controller

What you get out of the box

  • No RouteAuthorization → the SecurityMiddleware passes the request straight to the controller. Guest and authenticated clients are both accepted.
  • OpenAPI coverageGET /health shows up in the generated spec with a 200 response whose schema matches GetHealthResponse::getDocumentation().
  • Locale + rate-limit headersContent-Language is added by the middleware stack, and if you ever add a rate limit to this route, the X-RateLimit-* headers appear automatically.

Variations

  • Add a version or uptime field — extend the response with more StringProperty / IntegerProperty entries and include them in toArray().
  • Return 503 when a dependency is down — declare a second response class (e.g. ServiceUnavailableResponse) in getResponseClasses(), and return whichever matches the actual check result.
  • Keep it public but log anonymous calls — read $request->getAuthIdentity()->isAuthenticated() inside __invoke(); since no RouteAuthorization was set, the identity is always populated (guest or real) but never rejected.