Working with REST APIs 🔗

<?php
// A REST API answers in JSON, not HTML. Two lines make any response JSON.

// 1) Tell the browser the body is JSON (this is the "Content-Type" header).
header('Content-Type: application/json');

// 2) Build a normal PHP array, then turn it into a JSON string with json_encode().
$book = [
    'id'     => 1,
    'title'  => 'PHP for Beginners',
    'inStock' => true,
];

echo json_encode($book);   // sends: {"id":1,"title":"PHP for Beginners","inStock":true}
?>

Request:  GET /book.php

Response headers:
  Content-Type: application/json

Response body:
{"id":1,"title":"PHP for Beginners","inStock":true}

<?php
header('Content-Type: application/json');

// $_SERVER['REQUEST_METHOD'] tells you HOW the client asked: GET, POST, PUT, DELETE.
// You branch on it to decide what to do — this is the core of every REST endpoint.
$method = $_SERVER['REQUEST_METHOD'];

if ($method === 'GET') {
    // GET = "read". Send data back.
    echo json_encode(['action' => 'read a book']);
} elseif ($method === 'POST') {
    // POST = "create". Make a new thing.
    echo json_encode(['action' => 'create a book']);
} elseif ($method === 'PUT') {
    // PUT = "update". Replace an existing thing.
    echo json_encode(['action' => 'update a book']);
} elseif ($method === 'DELETE') {
    // DELETE = "remove".
    echo json_encode(['action' => 'delete a book']);
} else {
    // Anything else isn't allowed on this endpoint.
    http_response_code(405);                          // 405 = Method Not Allowed
    echo json_encode(['error' => 'Method not allowed']);
}
?>

Request:  POST /books.php

Response body:
{"action":"create a book"}

<?php
header('Content-Type: application/json');

// A POST/PUT request carries its data in the request BODY as raw JSON.
// php://input is the raw body; json_decode turns that JSON string into PHP data.
$raw  = file_get_contents('php://input');   // e.g. '{"title":"Dune","author":"Herbert"}'
$data = json_decode($raw, true);            // true => decode into an associative array

// ALWAYS validate. json_decode returns null if the body was missing or invalid JSON.
if (!is_array($data) || empty($data['title'])) {
    http_response_code(400);                          // 400 = Bad Request
    echo json_encode(['error' => 'A "title" field is required']);
    exit;                                             // stop here — don't continue
}

// Input is good — pretend we saved it and return the created record.
http_response_code(201);                              // 201 = Created
echo json_encode([
    'id'     => 42,
    'title'  => $data['title'],
    'author' => $data['author'] ?? 'Unknown',         // ?? = default if key missing
]);
?>

Request:  POST /books.php
Body:     {"title":"Dune","author":"Herbert"}

Response status: 201 Created

Response body:
{"id":42,"title":"Dune","author":"Herbert"}

<?php
// A tiny router: one file that handles a whole "/books" resource.
// It reads the METHOD and the id from the URL, then dispatches.

header('Content-Type: application/json');

// CORS: let a browser app on another domain call this API.
header('Access-Control-Allow-Origin: *');                       // who may call us (* = anyone)
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE'); // which methods are allowed
header('Access-Control-Allow-Headers: Content-Type');           // which request headers are allowed

// Browsers send a "preflight" OPTIONS request before a real cross-origin call.
// Answer it with 204 (No Content) and stop.
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(204);
    exit;
}

$method = $_SERVER['REQUEST_METHOD'];
$id     = $_GET['id'] ?? null;          // /books.php?id=1  ->  $id is "1"

// Pretend "database".
$books = [1 => ['id' => 1, 'title' => 'PHP for Beginners']];

if ($method === 'GET' && $id === null) {
    echo json_encode(array_values($books));            // list all books
} elseif ($method === 'GET' && isset($books[$id])) {
    echo json_encode($books[$id]);                     // one book
} elseif ($method === 'GET') {
    http_response_code(404);                            // 404 = Not Found
    echo json_encode(['error' => 'Book not found']);
} elseif ($method === 'POST') {
    $data = json_decode(file_get_contents('php://input'), true);
    http_response_code(201);
    echo json_encode(['id' => 2, 'title' => $data['title'] ?? '']);
} else {
    http_response_code(405);
    echo json_encode(['error' => 'Method not allowed']);
}
?>

Request:  GET /books.php

Response body:
[{"id":1,"title":"PHP for Beginners"}]

----

Request:  GET /books.php?id=99

Response status: 404 Not Found
Response body:
{"error":"Book not found"}

<?php
// The other half of REST: CONSUMING an API from PHP.

// Option A — cURL (built in, full control).
$ch = curl_init('https://api.example.com/books/1');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);   // return the body as a string
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Accept: application/json']);
$response = curl_exec($ch);
$status   = curl_getinfo($ch, CURLINFO_HTTP_CODE); // the status code, e.g. 200
curl_close($ch);

$book = json_decode($response, true);              // JSON string -> PHP array
echo "cURL got HTTP {$status}: {$book['title']}\n";

// Option B — file_get_contents (one line, great for simple GETs).
$raw  = file_get_contents('https://api.example.com/books/1');
$book = json_decode($raw, true);
echo "file_get_contents got: {$book['title']}\n";
?>

cURL got HTTP 200: PHP for Beginners
file_get_contents got: PHP for Beginners

<?php
// 🎯 YOUR TURN — return a single user as JSON.
// Fill in each blank marked ___ , then run it.

// 1) Set the Content-Type header so the client knows it's JSON
___('Content-Type: application/json');   // 👉 the function that sends a header

$user = ['id' => 7, 'name' => 'Sam', 'admin' => false];

// 2) Turn the array into a JSON string and echo it
echo ___($user);                          // 👉 the function that makes JSON

// ✅ Expected response body:
//    {"id":7,"name":"Sam","admin":false}
?>

Request:  GET /user.php

Response body:
{"id":7,"name":"Sam","admin":false}

<?php
header('Content-Type: application/json');

// 🎯 YOUR TURN — only allow DELETE on this endpoint.
// Fill in the blanks so a DELETE returns 200, and anything else returns 405.

$method = $_SERVER[___];                  // 👉 the key that holds the HTTP method

if ($method === ___) {                    // 👉 the method name, in "quotes"
    echo json_encode(['deleted' => true]);
} else {
    http_response_code(___);              // 👉 the "Method Not Allowed" status code
    echo json_encode(['error' => 'Use DELETE']);
}

// ✅ Expected:
//   DELETE request -> 200  {"deleted":true}
//   GET request    -> 405  {"error":"Use DELETE"}
?>

Request:  DELETE /books.php?id=1

Response status: 200 OK
Response body:
{"deleted":true}