Laravel API Audit

Analyze a Laravel API project's code against proven API development practices. Scan the relevant PHP source files (excluding vendor/, node_modules/, storage/) and produce a structured report of findings with actionable suggestions.

This is NOT a security audit and NOT a general Laravel structure audit. Focus on API-specific behavior: contracts, JSON responses, validation, error handling, authentication, performance, testing, and route design.

Before You Flag Anything

Read enough of the codebase to understand the project context first:

• Check composer.json and core bootstrapping to confirm the Laravel version and installed packages
• Detect how the API is mounted: routes/api.php, routes/web.php, custom route files, or routes loaded from bootstrap/app.php
• Detect the authentication approach before judging auth code: Sanctum, Passport, JWT, session/cookie auth, custom tokens, or no auth
• Check route groups and global middleware before flagging individual routes
• Check exception rendering and middleware before flagging controller-level JSON issues
• Distinguish public APIs, internal APIs, SPA backends, mobile backends, and webhook-only APIs

Present findings as suggestions, not mandates. API design involves trade-offs, and intentional consistency matters.