REST API in PHP (Full Code)

What is a REST API

A REST API lets programs share data over HTTP. A client (a phone app, another site, JavaScript) sends a request to a URL, and your PHP server replies with data — almost always as JSON. Instead of returning a web page, the server returns clean data the client can use.

HTTP methods

Using the right method for each action is what makes an API "RESTful" and easy for others to understand.

Sending JSON

<?php
  header("Content-Type: application/json");
  $data = ["name" => "Aman", "class" => 12];
  echo json_encode($data);
?>

The header tells the client the reply is JSON, and json_encode turns your PHP array into a JSON string. This is the core of every API response.

Reading request data

<?php
  $method = $_SERVER["REQUEST_METHOD"];   // GET, POST...
  $id = $_GET["id"] ?? null;              // ?id=5 in URL

  // for a JSON body (POST/PUT):
  $body = json_decode(file_get_contents("php://input"), true);
?>

You read the method from $_SERVER, URL parameters from $_GET, and a raw JSON body from php://input, which you decode into an array.

A simple endpoint

<?php
  header("Content-Type: application/json");
  $method = $_SERVER["REQUEST_METHOD"];

  if ($method === "GET") {
      echo json_encode(["message" => "Here is your data"]);
  } elseif ($method === "POST") {
      http_response_code(201);
      echo json_encode(["message" => "Created"]);
  } else {
      http_response_code(405);
      echo json_encode(["error" => "Method not allowed"]);
  }
?>

This single file responds differently based on the HTTP method — the basic shape of a real API endpoint.

Status codes

Tell the client what happened with http_response_code().

<?php
  http_response_code(404);
  echo json_encode(["error" => "Not found"]);
?>

Common codes: 200 OK, 201 Created, 400 Bad Request, 404 Not Found, 500 Server Error. Correct codes let clients react properly instead of guessing.

Common mistakes

• Forgetting the JSON header. Without it, clients may not treat the reply as JSON.
• Always returning 200. Use real status codes so errors are clear.
• Reading a JSON body from $_POST. Raw JSON comes from php://input, not $_POST.
• No input validation. API input is user input — validate and use prepared statements.

Summary

• A REST API shares data over HTTP, usually as JSON.
• Methods map to CRUD: GET, POST, PUT/PATCH, DELETE.
• Return JSON with the header plus json_encode.
• Read the method, $_GET, and a JSON body from php://input.
• Set correct status codes with http_response_code().

Next, format data with PHP JSON, or secure your API with JWT authentication.