Reference

All classes live under Tomaj\NetteApi.

Core

Class	What it does	Guide
ApiDecider	registry of endpoints: addApi(), getApi(), getApis(), enableGlobalPreflight()	Architecture
Api	one registered endpoint: endpoint, handler, authorization, rate limit	Architecture
ApiHolder	used inside ApiDecider: how it stores an endpoint before its handler is created; the handler can still be a class or service name	ApiDecider
EndpointIdentifier / EndpointInterface	method, version, package, action	Handlers
Presenters\ApiPresenter	runs a request step by step	ApiPresenter pipeline

Handlers

Class	What it does	Guide
Handlers\ApiHandlerInterface, BaseHandler	your endpoints	Handlers
Handlers\OpenApiHandler	OpenAPI 3.0 document	OpenAPI
Handlers\ApiListingHandler	JSON list of the endpoints in its own version	Handlers
Handlers\AlwaysOkHandler, EchoHandler	health check and test endpoints	Handlers
Handlers\DefaultHandler	404 Unknown api endpoint	Architecture
Handlers\CorsPreflightHandler(Interface)	answers OPTIONS	CORS

Params and validation

Class	What it does	Guide
Params\GetInputParam, PostInputParam, PutInputParam, CookieInputParam, FileInputParam, RawInputParam, JsonInputParam	one input each	Params
Params\InputParam, ParamInterface, ParamsProcessor	the base class and the processing	Params
Validation\InputValidator, JsonSchemaValidator, InputType (enum)	value checks	Params
ValidationResult\ValidationResult(Interface)	the result of a check	Params

Responses and outputs

Class	What it does	Guide
Response\ResponseInterface	what every response implements	Outputs
Response\JsonApiResponse, TextApiResponse, XmlApiResponse, RedirectResponse	what handle() returns	Outputs
Output\JsonOutput, RedirectOutput, AbstractOutput, OutputInterface	declared outputs	Outputs
Output\Configurator\ConfiguratorInterface, EnvConfigurator, QueryConfigurator, DebuggerConfigurator	when to check outputs and show details	Outputs
Error\ErrorHandlerInterface, DefaultErrorHandler	error responses	Error handling

Security

Class	What it does	Guide
Authorization\NoAuthorization, BearerTokenAuthorization, HeaderApiKeyAuthentication, QueryApiKeyAuthentication, CookieApiKeyAuthentication, BasicAuthentication	built-in authorization	Authorization
Authorization\ApiAuthorizationInterface, TokenAuthorization	your own	Authorization
Misc\TokenRepositoryInterface, StaticTokenRepository	tokens and their IPs	Authorization
Misc\IpDetectorInterface, IpDetector, StaticIpDetector	the client IP	Authorization
RateLimit\RateLimitInterface, RateLimitResponse, NoRateLimit	rate limiting	Rate limiting

Logging, links and console

Class	What it does	Guide
Logger\ApiLoggerInterface	request log	Logging
Link\ApiLink, ApiLinkExtension, ApiLinkNode	URLs and the {apiLink} tag	Links
Component\ApiListingControl, ApiConsoleControl, ApiConsoleFormFactoryInterface, DefaultApiConsoleFormFactory	web console	Web console
Misc\ConsoleRequest, ConsoleResponse	the console's cURL request	Web console
Misc\CorsOriginAllowlist	internal (@internal), used by setCorsAllowedOrigins(); may change in 4.0	CORS
Misc\OpenApiTransform	helpers for OpenAPI	OpenAPI

FAQ

Which classes are final?

Presenters\ApiPresenter, Error\DefaultErrorHandler, the Latte classes Link\ApiLinkExtension and Link\ApiLinkNode, and the internal Misc\CorsOriginAllowlist are final; wrap them instead of extending. See Error handling.

Since 4.0 these are final too: Api, ApiHolder, EndpointIdentifier, Authorization\NoAuthorization, RateLimit\NoRateLimit, RateLimit\RateLimitResponse, Misc\IpDetector, Misc\StaticIpDetector, Misc\StaticTokenRepository, Misc\ConsoleRequest, Misc\ConsoleResponse, Misc\OpenApiTransform, Params\ParamsProcessor, Validation\InputValidator, Validation\JsonSchemaValidator, ValidationResult\ValidationResult, the output configurators DebuggerConfigurator, EnvConfigurator and QueryConfigurator, and OpenApi\SchemaRegistry and OpenApi\EndpointFilter. Implement the matching interface (IpDetectorInterface, TokenRepositoryInterface, ApiAuthorizationInterface, RateLimitInterface, ConfiguratorInterface, …) instead of extending them. Handlers, params, outputs, responses, authorizations, the OpenAPI builders, ApiDecider, ApiLink, the console components and DefaultApiConsoleFormFactory stay open for extension.

Where are the method signatures?

In the source on GitHub; the guide pages show the ones you use.

Which classes are deprecated?

None. setExample() on params and outputs was removed in 4.0; use addExample(). The old StaticBearerTokenRepository and BearerTokenRepositoryInterface were removed in 4.0. Use StaticTokenRepository and TokenRepositoryInterface, which work the same way.

Is there a DI extension?

No, everything is registered as plain services in NEON, see Getting started.

What does a full project look like?

See the examples.