README

Comprehensive REST and GraphQL APIs for seamless e-commerce integration and extensibility.

Requirements

PHP 8.3+
Bagisto v2.4.7 (the version this package is tested against in CI)
Composer 2
MySQL 8.0+ or PostgreSQL 14+
API Platform for Laravel — api-platform/laravel and api-platform/graphql (~4.3.8), which bring in the remaining api-platform/* components at a matching version, installed automatically via composer require

Installation

Method 1: Quick Start (Composer Installation – Recommended)

The fastest way to get started:

composer require bagisto/bagisto-api
php artisan bagisto-api-platform:install

Your APIs are now ready! Access them at:

API Landing: https://your-domain.com/api
REST API Docs (Shop): https://your-domain.com/api/shop/docs
REST API Docs (Admin): https://your-domain.com/api/admin/docs
GraphQL Playground (Shop): https://your-domain.com/api/graphiql
GraphQL Playground (Admin): https://your-domain.com/api/admin/graphiql

Method 2: Manual Installation

Use this method if you need more control over the setup.

Step 1: Download and Extract

Download the BagistoApi package from GitHub
Extract it to: packages/Webkul/BagistoApi/

Step 2: Register Service Provider

Edit bootstrap/providers.php:

<?php

return [
    // ...existing providers...
    Webkul\BagistoApi\Providers\BagistoApiServiceProvider::class,
    // ...rest of providers...
];

Step 3: Update Autoloading

Edit composer.json and update the autoload section:

{
  "autoload": {
    "psr-4": {
      "Webkul\\BagistoApi\\": "packages/Webkul/BagistoApi/src"
    }
  }
}

Step 4: Install Dependencies

composer require \
  api-platform/laravel:~4.3.8 \
  api-platform/graphql:~4.3.8

Step 5: Run the installation

php artisan bagisto-api-platform:install

Step 6: Environment Setup (Update in the .env)

STOREFRONT_DEFAULT_RATE_LIMIT=100
STOREFRONT_CACHE_TTL=60
STOREFRONT_KEY_PREFIX=storefront_key_
STOREFRONT_PLAYGROUND_KEY=pk_storefront_xxxxxxxxxxxxxxxxxxxxxxxxxx 
API_PLAYGROUND_AUTO_INJECT_STOREFRONT_KEY=true

Access Points

Once verified, access the APIs at:

API Landing: https://your-domain.com/api
REST API (Shop): https://your-domain.com/api/shop/
REST API (Admin): https://your-domain.com/api/admin/
REST API Docs (Shop): https://your-domain.com/api/shop/docs
REST API Docs (Admin): https://your-domain.com/api/admin/docs
GraphQL Playground (Shop): https://your-domain.com/api/graphiql
GraphQL Playground (Admin): https://your-domain.com/api/admin/graphiql

Exporting the API Schema

Generate schema files for the shop and admin APIs — OpenAPI JSON (REST) and GraphQL SDL — to import into Postman, a client/code generator, or a mock server without calling a live server:

php artisan bagisto-api-platform:export-schema

The files are written to schema/generated/:

File	Contents
`openapi-shop.json` / `openapi-admin.json`	OpenAPI for each REST surface
`shop.graphql` / `admin.graphql`	GraphQL SDL for each surface
`graphql-operations-shop.json` / `-admin.json`	Every root GraphQL field mapped to its resource tag

Each spec is scoped to its own surface: the storefront spec contains no admin path, schema, or tag, and the admin spec contains no storefront one. The command refuses to write a schema that leaks another surface, references a definition it does not include, carries an unused definition, or contains a storefront key.

Options:

--path=<dir> — write to a different directory
--transport=all|rest|graphql — limit to one transport (default all)

Re-running overwrites those six files and nothing else. schema/tools/build-collection.php turns the exported specs into the Postman collections; it takes the target directory as an argument:

php schema/tools/build-collection.php /path/to/bagisto-api-collection/collections

Postman Collections

Ready-to-import Postman collections for both API surfaces live in their own repository:

github.com/bagisto/bagisto-api-collection

Import a collection and its environment there, fill in your store URL and a key, and every endpoint is ready to send — REST and GraphQL, for both the storefront and the admin API. That repository is the one to point clients and integrators at; this package holds the schemas the collections are generated from.

Admin API Authentication

Admin endpoints (/api/admin/* and /api/admin/graphql) require an integration-token Bearer header:

Authorization: Bearer id|generated-token

To generate a token:

Log into the Bagisto admin panel.
Enable the module first: navigate to Configuration → API → Integration → Module Settings and turn Enabled on. (Without this, the Integration menu stays hidden.)
Navigate to Settings → Integration.
Click Create, fill in the name / description / assigned admin / permission mode (All, Custom, or Same as Web) / optional IP allowlist / rate limits / expiry, and save as a draft.
Click Generate. The plaintext token is shown once — copy it immediately. You won't be able to view it again; if lost, use Regenerate to issue a new one.

Each token is scoped to a single admin user and inherits that admin's role permissions — so tokens can never do more than their owner could in the admin UI. To issue tokens to multiple admins, create one token per admin (each admin can hold only one active token at a time).

Tokens can be revoked at any time from the same page or via the signed link in the lifecycle notification email sent to the token owner.

Documentation

Bagisto API: Demo Page
API Documentation: Bagisto API Docs
GraphQL Playground (Shop): Interactive Playground
GraphQL Playground (Admin): Interactive Playground
Release history: see CHANGELOG.md

Support

For issues and questions, please visit:

📝 License

The Bagisto API Platform is open-source software licensed under the MIT license.

bagisto / bagisto-api

Maintainers

Package info

Statistics

Security