# API Routing

API endpoints use the same RouteBuilder and controller-action handlers as web routes. The application bootstrap decides which route file to load and whether to mount it below a prefix. DBM Platform mounts bootstrap/api.php under /api; therefore the declared /crypto/market/{symbol} path is reached at /api/crypto/market/{symbol}.

# Define an API route

$routes->get('/crypto/market/{symbol}', [CryptoMarketApiController::class, 'market'], 'api_crypto_market');
$routes->get('/crypto/market/{symbol}/history', [CryptoMarketApiController::class, 'history'], 'api_crypto_history');

A route declaration does not implement authentication or business logic by itself. Protect sensitive routes by attaching the appropriate middleware in the application's route group or middleware stack. Framework middleware such as JwtAuthMiddleware can validate bearer tokens when configured with the application's JWT service.

# JSON response conventions

ApiResponder provides consistent success, error, and validation-error responses:

return ApiResponder::success('Market data retrieved.', $marketData);

return ApiResponder::error('Cryptocurrency symbol is required.', 400);

Success responses include status, message, and data; error responses include status and message. BaseApiController::jsonResponse() remains available when a custom body shape is needed. Keep one response convention consistent across a given API surface.

# Calling endpoints

A client should call the effective URL, including the application's prefix, and send JSON content headers when using a JSON body. The application must implement its own login/token issuance and user/order resources unless those modules explicitly register them. See API Endpoints and Authentication for the framework JWT service and the current platform example.