PHP API Reference

PHP API Reference v0.17.0¶

Functions¶

schemaQueryOnly()¶

Create a simple schema configuration with only Query type.

This is a convenience function for schemas that only have queries.

Returns:

A QueryOnlyConfig with default settings

Signature:

public static function schemaQueryOnly(): QueryOnlyConfig

Example:

$result = schemaQueryOnly();

Returns: QueryOnlyConfig

schemaQueryMutation()¶

Create a schema configuration with Query and Mutation types.

This is a convenience function for schemas with queries and mutations but no subscriptions.

Returns:

A QueryMutationConfig with default settings

Signature:

public static function schemaQueryMutation(): QueryMutationConfig

Example:

$result = schemaQueryMutation();

Returns: QueryMutationConfig

schemaFull()¶

Create a schema configuration with all three root types.

This is a convenience function for fully-featured schemas.

Returns:

A FullSchemaConfig with default settings

Signature:

public static function schemaFull(): FullSchemaConfig

Example:

$result = schemaFull();

Returns: FullSchemaConfig

Types¶

ApiKeyAuthConfig¶

Per-route API key authentication requirement.

Mirrors spikard_http::ApiKeyConfig for the same reason JwtAuthConfig mirrors spikard_http::JwtConfig: spikard-core cannot depend on spikard-http.

ApiKeyConfig¶

API Key authentication configuration

AsyncApiConfig¶

AsyncAPI HTTP endpoint configuration

AuthorizationConfig¶

Per-route roles/scopes/permissions authorization requirement.

spikard_http::auth::Claims does not yet carry roles, scopes, or permissions, so nothing can enforce this today. This type only defines the requirement shape; a later phase must extend Claims (or an equivalent claims-decoding path) to populate them before enforcement is possible.

Deserialization goes through AuthorizationConfigRepr rather than a derive so the fixture's singular {"required_role": "admin"} shape (fixtures/problem_details.json's problem_details_403_forbidden) populates required_roles instead of being silently dropped as an unrecognized field — a config that parses to "no constraint" from real authorization data is a vacuous-pass bug, not a compatibility shim. deny_unknown_fields on the repr means any other unrecognized key is a loud deserialize error instead.

BackgroundJobMetadata¶

BackgroundTaskConfig¶

Configuration for in-process background task execution.

CompressionConfig¶

Compression configuration shared across runtimes

ContactInfo¶

Contact information

CorsConfig¶

CORS configuration for a route

DynamicSchemaConfig¶

Configuration for building and executing a dynamic-SDL schema.

FieldErrorSpec¶

A field-level error to inject at a specific response path.

path is the dot-separated sequence of field names from the operation root to the field that should fail, e.g. "user" for a top-level field or "order.customer" for a nested one.

FullSchemaConfig¶

Configuration for fully-featured schemas with Query, Mutation, and Subscription types

GraphQlRouteConfig¶

Configuration for GraphQL routes

Provides a builder pattern for configuring GraphQL route parameters for the Spikard HTTP server's routing system.

Methods¶

new()¶

Create a new GraphQL route configuration with defaults

Default values:

• path: "/graphql"
• method: "POST"
• enable_playground: false

Signature:

public static function new(): GraphQlRouteConfig

Example:

$result = GraphQlRouteConfig::new();

Returns: GraphQlRouteConfig

path()¶

Set the HTTP path for the GraphQL endpoint

Signature:

public function path(string $path): GraphQlRouteConfig

Example:

$result = $instance->path("value");

Parameters:

Returns: GraphQlRouteConfig

method()¶

Set the HTTP method for the GraphQL endpoint

Signature:

public function method(string $method): GraphQlRouteConfig

Example:

$result = $instance->method("value");

Parameters:

Returns: GraphQlRouteConfig

enablePlayground()¶

Enable or disable the GraphQL Playground UI

Signature:

public function enablePlayground(bool $enable): GraphQlRouteConfig

Example:

$result = $instance->enablePlayground(true);

Parameters:

Returns: GraphQlRouteConfig

description()¶

Set a custom description for documentation

Signature:

public function description(string $description): GraphQlRouteConfig

Example:

$result = $instance->description("value");

Parameters:

Returns: GraphQlRouteConfig

getPath()¶

Get the configured path

Signature:

public function getPath(): string

Example:

$result = $instance->getPath();

Returns: string

getMethod()¶

Get the configured method

Signature:

public function getMethod(): string

Example:

$result = $instance->getMethod();

Returns: string

isPlaygroundEnabled()¶

Check if playground is enabled

Signature:

public function isPlaygroundEnabled(): bool

Example:

$result = $instance->isPlaygroundEnabled();

Returns: bool

getDescription()¶

Get the description if set

Signature:

public function getDescription(): ?string

Example:

$result = $instance->getDescription();

Returns: ?string

GraphQlSubscriptionSnapshot¶

Snapshot of a GraphQL subscription exchange over WebSocket.

Derives Serialize so language bindings (e.g. the JNI backend) can marshal it across the FFI boundary via serde_json without a hand-written wrapper.

GrpcConfig¶

Configuration for gRPC support

Controls how the server handles gRPC requests, including compression, timeouts, and protocol settings.

Stream Limits¶

This configuration enforces message-level size limits but delegates concurrent stream limiting to the HTTP/2 transport layer:

• Message Size Limits: The max_message_size field is enforced per individual message (request or response) in both unary and streaming RPCs. When a single message exceeds this limit, the request is rejected with PAYLOAD_TOO_LARGE (HTTP 413).

• Concurrent Stream Limits: The max_concurrent_streams is an advisory configuration passed to the HTTP/2 layer for connection-level stream negotiation. The HTTP/2 transport automatically enforces this limit and returns GOAWAY frames when exceeded. Applications should not rely on custom enforcement of this limit.

• Stream Response Size Limits: The max_stream_response_bytes field caps the total encoded bytes emitted across a server-streaming or bidi-streaming response. When the cumulative size exceeds the limit, the stream is terminated with tonic::Status::resource_exhausted. Defaults to null (unbounded).

IntoHandler¶

Convert user-facing handler functions into the low-level Handler trait.

Methods¶

intoHandler()¶

Convert this value into a shared request handler.

Signature:

public function intoHandler(): Handler

Example:

$result = $instance->intoHandler();

Returns: Handler

JsonRpcConfig¶

JSON-RPC server configuration

JsonRpcMethodInfo¶

JSON-RPC method metadata for routes that support JSON-RPC

This struct captures the metadata needed to expose HTTP routes as JSON-RPC methods, enabling discovery and documentation of RPC-compatible endpoints.

JwtAuthConfig¶

Per-route JWT authentication requirement.

spikard-http defines the canonical JwtConfig used by ServerConfig.jwt_auth, but spikard-core cannot depend on spikard-http (the dependency runs the other way), so that type cannot be reused here. This mirrors its fields so a later enforcement phase in spikard-http can convert between the two without losing information.

secret and public_key are both optional because asymmetric algorithms (RS256, ES256, ...) verify against a public key rather than a shared secret; see fixtures/auth.json's jwt_config_algorithm_rs256, which carries public_key and no secret at all. Exactly one is expected to be populated for a given algorithm, but that cross-field invariant is left to a later enforcement phase rather than the type itself.

JwtConfig¶

JWT authentication configuration

LicenseInfo¶

License information

LifecycleHookRef¶

A single lifecycle hook reference within a LifecycleHooksConfig phase.

Matches the fixture shape exactly (fixtures/lifecycle_hooks.json, fixtures/di.json): each entry is an object with a required name and handler, an optional list of dependency keys, and an optional free-form config blob (e.g. {"max_requests": 10, "window_seconds": 60} for a rate-limiting hook). deny_unknown_fields turns future fixture drift into a loud error.

LifecycleHooksConfig¶

Per-route selection of registered lifecycle hooks.

ServerConfig.lifecycle_hooks holds Arc<dyn LifecycleHook> function pointers and is marked #[serde(skip)] / #[alef(skip)] because closures cannot be serialized or cross the FFI boundary. A per-route field with that same shape would be invisible to alef, and therefore invisible to every binding — defeating the purpose of exposing it here. This descriptor carries LifecycleHookRef entries instead: each one names a registered hook (plus its declared dependencies and optional config), so a later enforcement phase can resolve those names against the server's registered LifecycleHooks and run the matches for this route. The five fields mirror the five hook phases documented in the tower-middleware-and-lifecycle project convention (onRequest, preValidation, preHandler, onResponse, onError).

OpenApiConfig¶

OpenAPI configuration

ParseRequest¶

Request body for POST /asyncapi/parse

ParseResult¶

Full parse result returned by POST /asyncapi/parse

ParsedChannel¶

A single channel extracted from an AsyncAPI spec

ParsedMessage¶

A resolved message (name + JSON Schema)

ParsedOperation¶

A single operation extracted from an AsyncAPI spec

ProblemDetails¶

RFC 9457 Problem Details for HTTP APIs

A machine-readable format for specifying errors in HTTP API responses. Per RFC 9457, all fields are optional. The type field defaults to "about:blank" if not specified.

Content-Type¶

Responses using this struct should set:

Content-Type: application/problem+json

{
  "type": "<https://spikard.dev/errors/validation-error>",
  "title": "Request Validation Failed",
  "status": 422,
  "detail": "2 validation errors in request body",
  "errors": [...]
}

QueryMutationConfig¶

Configuration for schemas with Query and Mutation types

QueryOnlyConfig¶

Configuration for schemas with only Query type

RateLimitConfig¶

Rate limiting configuration shared across runtimes

Request¶

RequestIdConfig¶

Per-route request-id generation/propagation override.

Modeled as a struct rather than Option<bool> on RouteMetadata because the wire shape is an object, not a bare boolean: fixtures/request_id.json's request_id_middleware_can_be_disabled sends {"enabled": false}, which Option<bool> cannot deserialize at all ("invalid type: map, expected a boolean") — the very fixture whose purpose is proving the middleware can be disabled was the one that failed to parse.

Response¶

HTTP Response with custom status code, headers, and content

ResponseSnapshot¶

Snapshot of an Axum response used by higher-level language bindings.

RouteBuilder¶

Builder for defining a route.

Methods¶

new()¶

Create a new builder for the provided HTTP method and path.

Signature:

public static function new(Method $method, string $path): RouteBuilder

Example:

$result = RouteBuilder::new(new Method(), "value");

Parameters:

Returns: RouteBuilder

handlerName()¶

Assign an explicit handler name.

Signature:

public function handlerName(string $name): RouteBuilder

Example:

$result = $instance->handlerName("value");

Parameters:

Returns: RouteBuilder

requestSchemaJson()¶

Provide a raw JSON schema for the request body.

Signature:

public function requestSchemaJson(mixed $schema): RouteBuilder

Example:

$result = $instance->requestSchemaJson([]);

Parameters:

Returns: RouteBuilder

responseSchemaJson()¶

Provide a raw JSON schema for the response body.

Signature:

public function responseSchemaJson(mixed $schema): RouteBuilder

Example:

$result = $instance->responseSchemaJson([]);

Parameters:

Returns: RouteBuilder

paramsSchemaJson()¶

Provide a raw JSON schema for request parameters.

Signature:

public function paramsSchemaJson(mixed $schema): RouteBuilder

Example:

$result = $instance->paramsSchemaJson([]);

Parameters:

Returns: RouteBuilder

fileParamsJson()¶

Provide multipart file parameter configuration.

Signature:

public function fileParamsJson(mixed $schema): RouteBuilder

Example:

$result = $instance->fileParamsJson([]);

Parameters:

Returns: RouteBuilder

cors()¶

Attach a CORS configuration for this route.

Signature:

public function cors(CorsConfig $cors): RouteBuilder

Example:

$result = $instance->cors(new CorsConfig());

Parameters:

Returns: RouteBuilder

compression()¶

Attach a compression configuration for this route.

Signature:

public function compression(CompressionConfig $compression): RouteBuilder

Example:

$result = $instance->compression(new CompressionConfig());

Parameters:

Returns: RouteBuilder

bodyLimit()¶

Attach a per-route maximum request body size in bytes, overriding the server-global default.

Signature:

public function bodyLimit(int $maxBytes): RouteBuilder

Example:

$result = $instance->bodyLimit(42);

Parameters:

Returns: RouteBuilder

requestTimeout()¶

Attach a per-route request timeout in seconds, overriding the server-global default.

Signature:

public function requestTimeout(int $seconds): RouteBuilder

Example:

$result = $instance->requestTimeout(42);

Parameters:

Returns: RouteBuilder

rateLimit()¶

Attach a per-route rate limiting configuration, overriding the server-global default.

Signature:

public function rateLimit(RateLimitConfig $rateLimit): RouteBuilder

Example:

$result = $instance->rateLimit(new RateLimitConfig());

Parameters:

Returns: RouteBuilder

requestId()¶

Force per-route request-id generation on or off, overriding the server-global default.

Takes a plain bool rather than RequestIdConfig directly: the wire/metadata type had to become a struct to represent {"enabled": false} (see RequestIdConfig's docs), but this builder is the ergonomic call site (.request_id(true)), so it keeps accepting a bool and wraps it into RequestIdConfig internally in Self::into_metadata.

Signature:

public function requestId(bool $enabled): RouteBuilder

Example:

$result = $instance->requestId(true);

Parameters:

Returns: RouteBuilder

jwtAuth()¶

Require JWT authentication for this route.

Signature:

public function jwtAuth(JwtAuthConfig $config): RouteBuilder

Example:

$result = $instance->jwtAuth(new JwtAuthConfig());

Parameters:

Returns: RouteBuilder

apiKeyAuth()¶

Require API key authentication for this route.

Signature:

public function apiKeyAuth(ApiKeyAuthConfig $config): RouteBuilder

Example:

$result = $instance->apiKeyAuth(new ApiKeyAuthConfig());

Parameters:

Returns: RouteBuilder

authorization()¶

Attach a roles/scopes/permissions authorization requirement for this route.

Signature:

public function authorization(AuthorizationConfig $config): RouteBuilder

Example:

$result = $instance->authorization(new AuthorizationConfig());

Parameters:

Returns: RouteBuilder

lifecycleHooks()¶

Select registered lifecycle hooks to run for this route.

Signature:

public function lifecycleHooks(LifecycleHooksConfig $hooks): RouteBuilder

Example:

$result = $instance->lifecycleHooks(new LifecycleHooksConfig());

Parameters:

Returns: RouteBuilder

jsonrpcMethod()¶

Expose this route as a JSON-RPC method.

Signature:

public function jsonrpcMethod(JsonRpcMethodInfo $info): RouteBuilder

Example:

$result = $instance->jsonrpcMethod(new JsonRpcMethodInfo());

Parameters:

Returns: RouteBuilder

openrpcSpec()¶

Attach a literal OpenRPC method spec document for this route, overriding auto-derivation from the Self::jsonrpc_method metadata when present.

Signature:

public function openrpcSpec(mixed $spec): RouteBuilder

Example:

$result = $instance->openrpcSpec([]);

Parameters:

Returns: RouteBuilder

sync()¶

Mark the route as synchronous.

Signature:

public function sync(): RouteBuilder

Example:

$result = $instance->sync();

Returns: RouteBuilder

handlerDependencies()¶

Declare the dependency keys that must be resolved before this handler runs.

Signature:

public function handlerDependencies(array<string> $dependencies): RouteBuilder

Example:

$result = $instance->handlerDependencies([]);

Parameters:

Returns: RouteBuilder

SchemaConfig¶

Configuration for GraphQL schema building.

Encapsulates all schema-level configuration options including introspection control, complexity limits, and depth limits.

ServerConfig¶

Server configuration

ServerInfo¶

Server information

SseEvent¶

An individual SSE event

Represents a single Server-Sent Event to be sent to a connected client. Events can have an optional type, ID, and retry timeout for advanced scenarios.

SSE Format¶

Events are serialized to the following text format:

event: event_type
data: {"json":"value"}
id: event-123
retry: 3000

StaticFilesConfig¶

Static file serving configuration

TestingSseEvent¶

A single Server-Sent Event.

UploadFile¶

Represents an uploaded file from multipart/form-data requests.

This struct provides efficient access to file content with automatic base64 decoding and implements standard I/O traits for compatibility.

ValidateRequest¶

Request body for POST /asyncapi/validate

ValidationResponse¶

Response body for POST /asyncapi/validate

Enums¶

Method¶

HTTP method

LifecycleHookPhase¶

The five lifecycle phases a hook can be registered against.

Used to resolve a per-route named hook selection (LifecycleHooksConfig in spikard-core::http) against the hooks actually registered on the server: a name is looked up within one specific phase's registered hooks, not across all five, so a hook registered for on_response can never be silently picked up by a route asking for on_request.

SecuritySchemeInfo¶

Security scheme types

SnapshotError¶

Possible errors while converting an Axum response into a snapshot.

WebSocketMessage¶

A WebSocket message that can be text or binary.

Errors¶

AppError¶

Error type for application builder operations.

GraphQlError¶

Errors that can occur during GraphQL operations

These errors are compatible with async-graphql error handling and can be converted to structured HTTP responses matching the project's error fixtures.

SchemaError¶

Error type for schema building operations

Edit this page on GitHub