phases 9

* Versioned REST API under /api/v1
* Published Pages API
* Published Blog API
* Published News API
* Secure bearer API tokens
* SHA-256 token storage
* Token abilities
* Token expiry and revocation
* Token usage tracking
* Webhook subscriptions
* Site-specific webhooks
* HMAC-SHA256 webhook signatures
* Webhook delivery history
* Failure tracking
* OpenAPI 3.1 JSON documentation
* API administration screen
* Administration navigation
* API permissions
* Module registration
* Feature tests

Modules/Api/Config/config.php

@@ -0,0 +1,2 @@
+<?php
+return ['prefix'=>'api/v1','token_prefix'=>'cms_','pagination'=>20,'webhook_timeout'=>10,'openapi'=>['title'=>env('APP_NAME','Content Manager').' API','version'=>'1.0.0']];

Modules/Api/Database/Migrations/2026_07_24_090000_create_api_tokens_table.php

@@ -0,0 +1,3 @@
+<?php
+use Illuminate\Database\Migrations\Migration; use Illuminate\Database\Schema\Blueprint; use Illuminate\Support\Facades\Schema;
+return new class extends Migration { public function up(): void { Schema::create('api_tokens',function(Blueprint $t): void {$t->id();$t->foreignId('user_id')->constrained()->cascadeOnDelete();$t->string('name');$t->string('token',64)->unique();$t->json('abilities')->nullable();$t->timestamp('last_used_at')->nullable();$t->timestamp('expires_at')->nullable();$t->timestamps();}); } public function down(): void {Schema::dropIfExists('api_tokens');} };

Modules/Api/Database/Migrations/2026_07_24_090100_create_webhooks_tables.php

@@ -0,0 +1,3 @@
+<?php
+use Illuminate\Database\Migrations\Migration; use Illuminate\Database\Schema\Blueprint; use Illuminate\Support\Facades\Schema;
+return new class extends Migration { public function up(): void { Schema::create('webhooks',function(Blueprint $t): void {$t->id();$t->foreignId('site_id')->nullable()->constrained('sites')->nullOnDelete();$t->string('name');$t->string('url');$t->string('secret');$t->json('events');$t->boolean('is_active')->default(true);$t->unsignedSmallInteger('failure_count')->default(0);$t->timestamp('last_triggered_at')->nullable();$t->timestamps();}); Schema::create('webhook_deliveries',function(Blueprint $t): void {$t->id();$t->foreignId('webhook_id')->constrained()->cascadeOnDelete();$t->uuid('uuid')->unique();$t->string('event');$t->json('payload');$t->unsignedSmallInteger('response_status')->nullable();$t->text('response_body')->nullable();$t->unsignedSmallInteger('attempts')->default(0);$t->timestamp('delivered_at')->nullable();$t->timestamp('failed_at')->nullable();$t->timestamps();}); } public function down(): void {Schema::dropIfExists('webhook_deliveries');Schema::dropIfExists('webhooks');} };

Modules/Api/Http/Controllers/ApiController.php

@@ -0,0 +1,4 @@
+<?php
+namespace Modules\Api\Http\Controllers;
+use Illuminate\Http\RedirectResponse; use Illuminate\Http\Request; use Illuminate\Support\Str; use Illuminate\View\View; use Modules\Api\Models\ApiToken; use Modules\Api\Models\Webhook;
+final class ApiController {public function index(): View{return view('api::admin.index',['tokens'=>ApiToken::with('user')->latest()->paginate(20,'*','tokens'),'webhooks'=>Webhook::latest()->paginate(20,'*','webhooks')]);}public function storeToken(Request $r): RedirectResponse{$d=$r->validate(['name'=>'required|string|max:255','abilities'=>'nullable|string','expires_at'=>'nullable|date|after:now']);$abilities=array_values(array_filter(array_map('trim',explode(',',$d['abilities']?:'*'))));[,$plain]=ApiToken::issue($r->user(),$d['name'],$abilities,isset($d['expires_at'])?new \DateTimeImmutable($d['expires_at']):null);return back()->with('api_token',$plain)->with('status','API token created.');}public function destroyToken(ApiToken $token): RedirectResponse{$token->delete();return back()->with('status','API token revoked.');}public function storeWebhook(Request $r): RedirectResponse{$d=$r->validate(['name'=>'required|string|max:255','url'=>'required|url|max:2048','events'=>'required|string','site_id'=>'nullable|integer|exists:sites,id']);Webhook::create(['name'=>$d['name'],'url'=>$d['url'],'events'=>array_values(array_filter(array_map('trim',explode(',',$d['events'])))),'site_id'=>$d['site_id']??null,'secret'=>Str::random(48),'is_active'=>true]);return back()->with('status','Webhook created.');}public function destroyWebhook(Webhook $webhook): RedirectResponse{$webhook->delete();return back()->with('status','Webhook deleted.');}}

Modules/Api/Http/Controllers/ContentController.php

@@ -0,0 +1,4 @@
+<?php
+namespace Modules\Api\Http\Controllers;
+use Illuminate\Database\Eloquent\Builder; use Illuminate\Http\Resources\Json\AnonymousResourceCollection; use Modules\Api\Http\Resources\ContentResource; use Modules\Blog\Models\Blog; use Modules\News\Models\News; use Modules\Pages\Models\Page;
+final class ContentController {public function pages(): AnonymousResourceCollection{return $this->many(Page::query()->where('status','published'));}public function blog(): AnonymousResourceCollection{return $this->many(Blog::query()->published());}public function news(): AnonymousResourceCollection{return $this->many(News::query()->published());}public function page(Page $page): ContentResource{abort_unless($page->status==='published',404);return new ContentResource($page);}public function blogPost(Blog $blog): ContentResource{abort_unless(Blog::query()->published()->whereKey($blog)->exists(),404);return new ContentResource($blog);}public function newsArticle(News $news): ContentResource{abort_unless(News::query()->published()->whereKey($news)->exists(),404);return new ContentResource($news);}private function many(Builder $q): AnonymousResourceCollection{return ContentResource::collection($q->latest('updated_at')->paginate((int)config('api.pagination',20)));}}

Modules/Api/Http/Controllers/OpenApiController.php

@@ -0,0 +1,4 @@
+<?php
+namespace Modules\Api\Http\Controllers;
+use Illuminate\Http\JsonResponse;
+final class OpenApiController {public function __invoke(): JsonResponse{return response()->json(['openapi'=>'3.1.0','info'=>config('api.openapi'),'servers'=>[['url'=>url('/'.config('api.prefix','api/v1'))]],'components'=>['securitySchemes'=>['bearerAuth'=>['type'=>'http','scheme'=>'bearer']]],'paths'=>['/pages'=>['get'=>['summary'=>'List published pages','responses'=>['200'=>['description'=>'OK']]]],'/blog'=>['get'=>['summary'=>'List published blog posts','responses'=>['200'=>['description'=>'OK']]]],'/news'=>['get'=>['summary'=>'List published news','responses'=>['200'=>['description'=>'OK']]]],'/user'=>['get'=>['summary'=>'Authenticated user','security'=>[['bearerAuth'=>[]]],'responses'=>['200'=>['description'=>'OK'],'401'=>['description'=>'Unauthenticated']]]]]]);}}

Modules/Api/Http/Middleware/AuthenticateApiToken.php

@@ -0,0 +1,4 @@
+<?php
+namespace Modules\Api\Http\Middleware;
+use Closure; use Illuminate\Http\Request; use Modules\Api\Models\ApiToken; use Symfony\Component\HttpFoundation\Response;
+final class AuthenticateApiToken {public function handle(Request $r,Closure $next,?string $ability=null): Response{$plain=$r->bearerToken();if(!$plain)return response()->json(['message'=>'Unauthenticated.'],401);$token=ApiToken::with('user')->where('token',hash('sha256',$plain))->first();if(!$token||($token->expires_at&&$token->expires_at->isPast())||!$token->user)return response()->json(['message'=>'Invalid or expired API token.'],401);if($ability&&!$token->allows($ability))return response()->json(['message'=>'Insufficient token ability.'],403);$token->update(['last_used_at'=>now()]);auth()->setUser($token->user);$r->attributes->set('apiToken',$token);return $next($r);}}

Modules/Api/Http/Resources/ContentResource.php

@@ -0,0 +1,4 @@
+<?php
+namespace Modules\Api\Http\Resources;
+use Illuminate\Http\Request; use Illuminate\Http\Resources\Json\JsonResource;
+final class ContentResource extends JsonResource {public function toArray(Request $r): array{return ['id'=>$this->id,'type'=>$this->resource->getTable(),'title'=>$this->title,'slug'=>$this->slug,'excerpt'=>$this->excerpt??null,'content'=>$this->content??null,'status'=>$this->status??null,'featured_image'=>$this->featured_image??null,'published_at'=>$this->published_at??null,'updated_at'=>$this->updated_at];}}

Modules/Api/Models/ApiToken.php

@@ -0,0 +1,4 @@
+<?php
+namespace Modules\Api\Models;
+use App\Models\User; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\BelongsTo; use Illuminate\Support\Str;
+final class ApiToken extends Model { protected $fillable=['user_id','name','token','abilities','last_used_at','expires_at']; protected $hidden=['token']; protected function casts(): array{return ['abilities'=>'array','last_used_at'=>'datetime','expires_at'=>'datetime'];} public function user(): BelongsTo{return $this->belongsTo(User::class);} public static function issue(User $u,string $name,array $abilities=['*'],?\DateTimeInterface $expires=null): array {$plain=config('api.token_prefix','cms_').Str::random(64);$record=self::query()->create(['user_id'=>$u->id,'name'=>$name,'token'=>hash('sha256',$plain),'abilities'=>$abilities,'expires_at'=>$expires]);return [$record,$plain];} public function allows(string $ability): bool{$a=$this->abilities?:[];return in_array('*',$a,true)||in_array($ability,$a,true);} }

Modules/Api/Models/Webhook.php

@@ -0,0 +1,4 @@
+<?php
+namespace Modules\Api\Models;
+use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\HasMany;
+final class Webhook extends Model {protected $fillable=['site_id','name','url','secret','events','is_active','failure_count','last_triggered_at'];protected $hidden=['secret'];protected function casts(): array{return ['events'=>'array','is_active'=>'boolean','last_triggered_at'=>'datetime'];}public function deliveries(): HasMany{return $this->hasMany(WebhookDelivery::class);}public function subscribesTo(string $event): bool{return in_array('*',$this->events?:[],true)||in_array($event,$this->events?:[],true);}}

Modules/Api/Models/WebhookDelivery.php

@@ -0,0 +1,4 @@
+<?php
+namespace Modules\Api\Models;
+use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\Relations\BelongsTo;
+final class WebhookDelivery extends Model {protected $fillable=['webhook_id','uuid','event','payload','response_status','response_body','attempts','delivered_at','failed_at'];protected function casts(): array{return ['payload'=>'array','delivered_at'=>'datetime','failed_at'=>'datetime'];}public function webhook(): BelongsTo{return $this->belongsTo(Webhook::class);}}

Modules/Api/Providers/ApiServiceProvider.php

@@ -0,0 +1,5 @@
+<?php
+namespace Modules\Api\Providers;
+use Illuminate\Support\ServiceProvider;
+use Modules\Api\Services\WebhookDispatcher;
+final class ApiServiceProvider extends ServiceProvider { public function register(): void { $this->app->register(RouteServiceProvider::class); $this->mergeConfigFrom(module_path('Api','Config/config.php'),'api'); $this->app->singleton(WebhookDispatcher::class); } public function boot(): void { $this->loadMigrationsFrom(module_path('Api','Database/Migrations')); $this->loadViewsFrom(module_path('Api','Resources/views'),'api'); } }

Modules/Api/Providers/RouteServiceProvider.php

@@ -0,0 +1,5 @@
+<?php
+namespace Modules\Api\Providers;
+use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
+use Illuminate\Support\Facades\Route;
+final class RouteServiceProvider extends ServiceProvider { public function boot(): void { Route::middleware('api')->prefix(config('api.prefix','api/v1'))->name('api.v1.')->group(module_path('Api','Routes/api.php')); Route::middleware('web')->group(module_path('Api','Routes/web.php')); } }

Modules/Api/Resources/views/admin/index.blade.php

@@ -0,0 +1 @@
+<x-layouts.app :title="__('API & Webhooks')"><div class="space-y-8"><div><h1 class="text-2xl font-semibold">{{ __('API & Webhooks') }}</h1><p class="text-sm text-zinc-500">{{ __('Manage headless access, bearer tokens and webhook subscriptions.') }}</p></div>@if(session('status'))<flux:callout variant="success">{{ session('status') }}</flux:callout>@endif @if(session('api_token'))<flux:callout variant="warning"><strong>{{ __('Copy this token now') }}</strong><div class="mt-2 break-all font-mono">{{ session('api_token') }}</div></flux:callout>@endif<div class="grid gap-6 xl:grid-cols-2"><flux:card><h2 class="text-lg font-semibold">{{ __('Create token') }}</h2><form method="POST" action="{{ route('administration.api.tokens.store') }}" class="mt-4 space-y-4">@csrf<flux:input name="name" :label="__('Name')" required/><flux:input name="abilities" :label="__('Abilities')" value="content.read"/><flux:input name="expires_at" type="datetime-local" :label="__('Expires at')"/><flux:button type="submit" variant="primary">{{ __('Create') }}</flux:button></form></flux:card><flux:card><h2 class="text-lg font-semibold">{{ __('Create webhook') }}</h2><form method="POST" action="{{ route('administration.api.webhooks.store') }}" class="mt-4 space-y-4">@csrf<flux:input name="name" :label="__('Name')" required/><flux:input name="url" type="url" :label="__('URL')" required/><flux:input name="events" :label="__('Events')" value="content.published"/><flux:input name="site_id" type="number" :label="__('Site ID')"/><flux:button type="submit" variant="primary">{{ __('Create') }}</flux:button></form></flux:card></div><flux:card><div class="flex justify-between"><h2 class="text-lg font-semibold">{{ __('Tokens') }}</h2><a class="underline" href="{{ route('api.v1.openapi') }}">OpenAPI JSON</a></div>@forelse($tokens as $token)<div class="flex justify-between border-b py-3"><div>{{ $token->name }} <span class="text-sm text-zinc-500">{{ implode(', ', $token->abilities ?? []) }}</span></div><form method="POST" action="{{ route('administration.api.tokens.destroy',$token) }}">@csrf @method('DELETE')<flux:button size="sm" variant="danger">{{ __('Revoke') }}</flux:button></form></div>@empty<p class="py-4 text-zinc-500">{{ __('No tokens.') }}</p>@endforelse{{ $tokens->links() }}</flux:card><flux:card><h2 class="text-lg font-semibold">{{ __('Webhooks') }}</h2>@forelse($webhooks as $webhook)<div class="flex justify-between border-b py-3"><div>{{ $webhook->name }} <span class="text-sm text-zinc-500">{{ $webhook->url }}</span></div><form method="POST" action="{{ route('administration.api.webhooks.destroy',$webhook) }}">@csrf @method('DELETE')<flux:button size="sm" variant="danger">{{ __('Delete') }}</flux:button></form></div>@empty<p class="py-4 text-zinc-500">{{ __('No webhooks.') }}</p>@endforelse{{ $webhooks->links() }}</flux:card></div></x-layouts.app>

Modules/Api/Routes/api.php

@@ -0,0 +1,3 @@
+<?php
+use Illuminate\Http\Request; use Illuminate\Support\Facades\Route; use Modules\Api\Http\Controllers\ContentController; use Modules\Api\Http\Controllers\OpenApiController; use Modules\Api\Http\Middleware\AuthenticateApiToken;
+Route::get('/openapi.json',OpenApiController::class)->name('openapi');Route::controller(ContentController::class)->group(function():void{Route::get('/pages','pages');Route::get('/pages/{page}','page');Route::get('/blog','blog');Route::get('/blog/{blog}','blogPost');Route::get('/news','news');Route::get('/news/{news}','newsArticle');});Route::middleware(AuthenticateApiToken::class)->get('/user',fn(Request $r)=>$r->user());

Modules/Api/Routes/web.php

@@ -0,0 +1,3 @@
+<?php
+use Illuminate\Support\Facades\Route; use Modules\Api\Http\Controllers\ApiController;
+Route::middleware(['web','auth','permission:api.manage'])->prefix('administration/api')->name('administration.api.')->controller(ApiController::class)->group(function():void{Route::get('/','index')->name('index');Route::post('/tokens','storeToken')->name('tokens.store');Route::delete('/tokens/{token}','destroyToken')->name('tokens.destroy');Route::post('/webhooks','storeWebhook')->name('webhooks.store');Route::delete('/webhooks/{webhook}','destroyWebhook')->name('webhooks.destroy');});

Modules/Api/Services/WebhookDispatcher.php

@@ -0,0 +1,4 @@
+<?php
+namespace Modules\Api\Services;
+use Illuminate\Support\Facades\Http; use Illuminate\Support\Str; use Modules\Api\Models\Webhook; use Modules\Api\Models\WebhookDelivery;
+final class WebhookDispatcher {public function dispatch(string $event,array $payload,?int $siteId=null): void{Webhook::where('is_active',true)->get()->filter(fn(Webhook $h)=>($h->site_id===null||$h->site_id===$siteId)&&$h->subscribesTo($event))->each(function(Webhook $h)use($event,$payload):void{$uuid=(string)Str::uuid();$json=json_encode($payload,JSON_UNESCAPED_SLASHES)?:'{}';$delivery=WebhookDelivery::create(['webhook_id'=>$h->id,'uuid'=>$uuid,'event'=>$event,'payload'=>$payload,'attempts'=>1]);try{$res=Http::timeout((int)config('api.webhook_timeout',10))->withHeaders(['X-CMS-Event'=>$event,'X-CMS-Delivery'=>$uuid,'X-CMS-Signature'=>'sha256='.hash_hmac('sha256',$json,$h->getRawOriginal('secret'))])->withBody($json,'application/json')->post($h->url);$delivery->update(['response_status'=>$res->status(),'response_body'=>Str::limit($res->body(),10000),'delivered_at'=>$res->successful()?now():null,'failed_at'=>$res->successful()?null:now()]);$h->update(['last_triggered_at'=>now(),'failure_count'=>$res->successful()?0:$h->failure_count+1]);}catch(\Throwable $e){$delivery->update(['response_body'=>$e->getMessage(),'failed_at'=>now()]);$h->increment('failure_count');}});}}

Modules/Api/Tests/Feature/ApiModuleBootTest.php

@@ -0,0 +1,3 @@
+<?php
+use Modules\Api\Models\ApiToken;
+it('boots the api module',fn()=>expect(app()->providerIsLoaded(Modules\Api\Providers\ApiServiceProvider::class))->toBeTrue());it('hashes issued api tokens',function():void{$u=App\Models\User::factory()->create();[$t,$plain]=ApiToken::issue($u,'Test',['content.read']);expect($t->getRawOriginal('token'))->toBe(hash('sha256',$plain))->not->toBe($plain);});it('publishes openapi documentation',fn()=>$this->getJson('/api/v1/openapi.json')->assertOk()->assertJsonPath('openapi','3.1.0'));

Modules/Api/module.json

@@ -0,0 +1 @@
+{"name":"Api","alias":"api","version":"1.0.0","description":"REST APIs, bearer tokens, webhooks and OpenAPI.","keywords":["api","headless","webhooks"],"priority":90,"providers":["Modules\\Api\\Providers\\ApiServiceProvider"],"aliases":{},"files":[],"requires":["Core","Administration","Sites"]}

Modules/Roles/Database/Seeders/RolePermissionSeeder.php

@@ -59,6 +59,8 @@ final class RolePermissionSeeder extends Seeder
             'sites.manage',
             'sites.assign',
             'developer.access',
+            'api.view',
+            'api.manage',
         ];
 
         foreach ($permissions as $permission) {

modules_statuses.json

@@ -34,5 +34,6 @@
     "Workflow": true,
     "Localization": true,
     "Sites": true,
-    "Developer": true
+    "Developer": true,
+    "Api": true
 }

resources/themes/common/views/components/layouts/app/sidebar.blade.php

@@ -32,7 +32,7 @@
 <flux:sidebar.item icon="chat-bubble-left-right" :href="route('administration.testimonials.index')" :current="request()->routeIs('administration.testimonials.*')" wire:navigate>{{ __('Testimonials') }}</flux:sidebar.item>
 </flux:sidebar.group>
 <flux:sidebar.group :heading="__('Platform')" class="grid"><flux:sidebar.item icon="globe-alt" :href="route('administration.sites.index')" :current="request()->routeIs('administration.sites.*')" wire:navigate>{{ __('Sites') }}</flux:sidebar.item><flux:sidebar.item icon="home" :href="route('dashboard')" :current="request()->routeIs('dashboard')" wire:navigate>{{ __('Dashboard') }}</flux:sidebar.item><flux:sidebar.item icon="squares-2x2" :href="route('administration.dashboard')" :current="request()->routeIs('administration.dashboard')" wire:navigate>{{ __('Administration') }}</flux:sidebar.item></flux:sidebar.group>
-<flux:sidebar.group :heading="__('Developer')" class="grid"><flux:sidebar.item icon="command-line" href="{{ route('administration.developer.index') }}" :current="request()->routeIs('administration.developer.*')" wire:navigate>{{ __('Developer Tools') }}</flux:sidebar.item></flux:sidebar.group>
+<flux:sidebar.group :heading="__('Developer')" class="grid"><flux:sidebar.item icon="code-bracket" :href="route('administration.api.index')" :current="request()->routeIs('administration.api.*')" wire:navigate>{{ __('API & Webhooks') }}</flux:sidebar.item><flux:sidebar.item icon="command-line" href="{{ route('administration.developer.index') }}" :current="request()->routeIs('administration.developer.*')" wire:navigate>{{ __('Developer Tools') }}</flux:sidebar.item></flux:sidebar.group>
 <flux:sidebar.group :heading="__('Workflow')" class="grid"><flux:sidebar.item icon="arrows-right-left" :href="route('administration.workflows.index')" :current="request()->routeIs('administration.workflows.*')" wire:navigate>{{ __('Review Queue') }}</flux:sidebar.item></flux:sidebar.group>
 <flux:sidebar.group :heading="__('Management')" class="grid"><flux:sidebar.item icon="users" :href="route('administration.users.index')" :current="request()->routeIs('administration.users.*')" wire:navigate>{{ __('Users') }}</flux:sidebar.item><flux:sidebar.item icon="shield-check" :href="route('administration.roles.index')" :current="request()->routeIs('administration.roles.*')" wire:navigate>{{ __('Roles & Permissions') }}</flux:sidebar.item><flux:sidebar.item icon="photo" :href="route('administration.media.index')" :current="request()->routeIs('administration.media.*')" wire:navigate>{{ __('Media') }}</flux:sidebar.item><flux:sidebar.item icon="magnifying-glass" :href="route('administration.search.index')" :current="request()->routeIs('administration.search.*')" wire:navigate>{{ __('Search') }}</flux:sidebar.item></flux:sidebar.group>
 <flux:sidebar.group :heading="__('Configuration')" class="grid"><flux:sidebar.item icon="language" :href="route('administration.localization.index')" :current="request()->routeIs('administration.localization.*')" wire:navigate>{{ __('Localisation') }}</flux:sidebar.item><flux:sidebar.item icon="globe-alt" :href="route('administration.seo.index')" :current="request()->routeIs('administration.seo.*')" wire:navigate>{{ __('SEO') }}</flux:sidebar.item><flux:sidebar.item icon="cog-6-tooth" :href="route('administration.settings.index')" :current="request()->routeIs('administration.settings.*')" wire:navigate>{{ __('Settings') }}</flux:sidebar.item><flux:sidebar.item icon="cube" :href="route('administration.modules.index')" :current="request()->routeIs('administration.modules.*')" wire:navigate>{{ __('Modules') }}</flux:sidebar.item><flux:sidebar.item icon="clipboard-document-list" :href="route('administration.audit.index')" :current="request()->routeIs('administration.audit.*')" wire:navigate>{{ __('Audit Log') }}</flux:sidebar.item></flux:sidebar.group>