An API contract documented by design
The OpenAPI documentation and the test interface are generated from the code. The published contract stays aligned with what the API actually does, with no document to maintain by hand.
Expertise · API Platform
Offshore API Platform Developers: Documented, Tested REST and GraphQL APIs
Resource design, OpenAPI documentation, access rights, filters, caching and tests: we deliver business APIs in production that your team and partners can consume, evolve and maintain. Our offshore API Platform developers in Madagascar and Mauritius, overseen by our tech leads, join your team remotely as a dedicated team or deliver your project on a time-and-materials or fixed-price basis.
A free 30-minute video call, with no commitment, followed by a written summary with a ballpark estimate.
What it brings to your product
Why choose API Platform?
API Platform suits products whose API is a deliverable in its own right, with a readable, documented contract. It relies on Symfony components (security, validation, serialization, HTTP cache) and on Doctrine, which makes it consistent with an existing Symfony application.
REST and GraphQL on the same resources
The same resource can be exposed as JSON-LD (Hydra), JSON:API, HAL or GraphQL. Each consumer chooses the format that suits it, without duplicating logic on the server side.
The common building blocks already in place
Pagination, filters, sorting, validation, error handling and content negotiation are provided by the framework. The team writes less repetitive code and behavior stays consistent from one resource to the next.
The Symfony ecosystem at hand
Voters, Messenger, Doctrine, profiling and testing tools apply directly to the API. See our Symfony development expertise.
Our scope of work
What our offshore API Platform developers take on.
Resource design
Defining resources, their operations and their representations, on Doctrine entities or dedicated objects.
Security & access rights
Authenticating clients, restricting each operation and filtering data according to the user.
Performance & real time
Limiting queries, caching responses and pushing updates to clients.
Tests & version upgrades
Covering the API contract with automated tests and upgrading the framework without breaking consumers.
Our API Platform expertise
The API Platform ecosystem we master.
Resources & state
The ApiResource attribute, explicit operations, State Providers and State Processors to separate reading and writing data from how it is exposed. Dedicated objects (DTOs) when the API should not directly mirror the database schema.
Data & Doctrine
Doctrine ORM and migrations, serialization groups, validation with Symfony constraints, on relational databases such as PostgreSQL or MySQL.
Filters & pagination
Search, date, order and exists filters, custom filters, page-based or cursor-based pagination, partial pagination for large volumes.
Security
Security expressions per operation, Symfony voters, token authentication (JWT, OAuth2), Doctrine extensions to restrict collections to authorized data.
Cache & real time
HTTP cache with automatic response invalidation, application cache on Redis, Mercure to broadcast changes to subscribed clients.
Admin & generated clients
API Platform Admin, based on React Admin, for a back office built from the API documentation; a client generator to bootstrap a Next.js, React or Vue interface.
Security, filters and pagination
Controlled access on every operation.
An API exposes data more directly than a screen does. We define access rules operation by operation: who can read a collection, modify an item or see a specific field. Complex rules are carried by tested voters, and collections are filtered in the database so a user only receives what they are allowed to see.
Filters and pagination are part of the contract. We explicitly declare accepted parameters, limit page size and choose the pagination mode according to volume and use: page-based for a back office, cursor-based for synchronization or infinite scrolling.
Performance and real time
A fast API that keeps its clients informed.
API slowness often comes from the generated queries: relations loaded one by one, serialization of overly deep graphs, costly counts on large tables. We profile real operations before optimizing, then adjust serialization groups, joins and pagination.
API Platform’s HTTP cache makes it possible to serve responses from a proxy and invalidate them when data changes. For screens that must update without reloading, Mercure broadcasts resource changes to subscribed clients, while reserving private updates for authorized clients.
In the field
From the technology to a concrete use.
For a business application that serves a back office, a web application and a partner at the same time, we can expose a catalog of resources with different rights depending on the calling client. The back office is generated from the documentation, the public interface consumes the same API, and the partner receives a versioned OpenAPI contract. Tests check every operation, both denied and granted rights.
Back office and front end
An API designed for React and Next.js.
API Platform Admin builds an administration interface from the API documentation: lists, forms and filters are available quickly, then customized screen by screen. It is an efficient foundation for internal teams, as long as business rules stay on the server side.
For the front end, the OpenAPI documentation makes it possible to generate TypeScript types and clients, which reduces gaps between the API and the interface. We develop these interfaces in React or Next.js, with server-side rendering when SEO or display time requires it.
The choices that matter
The choices to examine before building.
Exposing Doctrine entities directly is fast, but it ties the API contract to the database schema. For a public or long-lived API, we often prefer dedicated objects and State Providers, which let the data model evolve without breaking consumers. The choice between REST and GraphQL, the versioning strategy and the deprecation policy are also decided at the start.
For an existing API, we start by identifying the consumers, the operations actually used and the gaps between the documentation and the behavior. A technical audit helps prioritize these topics before adding features.
Version upgrades
Moving from API Platform 3 to 4, then preparing what comes next.
API Platform 4 removed the features deprecated in 3.4: the recommended approach is to move to 3.4 first, address the deprecation warnings, then change major version. Version 4 requires at least PHP 8.2 and no longer declares the PUT operation by default, which can change the contract for clients that used it. The 5.x branch, now released, relies on Symfony 7.4 or 8.
We prepare these upgrades together with the Symfony and Doctrine updates, comparing the OpenAPI documentation before and after to detect changes visible to consumers. For choosing a Symfony version, see our article Symfony 7.4 or 8.0: how to choose. For APIs already in production, our application maintenance services cover these upgrades over time.
From work to deliverables
An API your team can take over.
The scope of work specifies the resources to build or take over, the consumers to serve and the acceptance conditions. Our tech leads validate the design and review the delivered code; we prepare what is needed to understand the changes, verify them and continue the work.
- Versioned OpenAPI contract
- Automated tests of operations and access rights
- Deployment and version upgrade procedures
Understanding the technology
API Platform in your project.
API Platform is an open source PHP framework dedicated to building APIs. Historically built on Symfony, it has also supported Laravel since version 4. From PHP classes described with attributes, it exposes REST and GraphQL operations, generates OpenAPI documentation and handles serialization, validation, pagination and filters.
We use it when an application must offer a stable API to several consumers: a web interface, a mobile app, a partner or another service in the information system. The framework handles the mechanics common to all APIs; project time goes into the business model, access rules and the quality of the contract.
Frequently asked questions
Your questions.
Do you have to choose between API Platform and Symfony?
No. API Platform is installed in a Symfony application and uses its components. It replaces hand-written API controllers, serialization and documentation, while business services, security and asynchronous processing remain standard Symfony code.
Is API Platform suitable for a simple REST API?
Yes, if the API needs to be documented, paginated, filtered and secured, which is the case for most business APIs. For a few very specific endpoints with no resources to expose, Symfony controllers are sometimes enough; we discuss this during scoping.
Can the same application offer both REST and GraphQL?
Yes. GraphQL is enabled on existing resources and shares their security and validation rules. However, query depth and complexity must be limited so that a client cannot trigger overly expensive processing.
How do you test an API built with API Platform?
With the testing tools provided by API Platform, based on Symfony’s HTTP client, we check every operation, its response codes, its access rights and whether responses match the published schema. Test datasets isolate each scenario, and tests run automatically on every change.
How does an upgrade from API Platform 3 to 4 work?
In two steps: move to 3.4 and fix deprecations, then move to version 4 with compatible PHP and Symfony versions. We compare the OpenAPI contract before and after, and warn consumers about any changes, such as PUT being removed from the default operations.
How can we work with your API Platform developers: dedicated team or fixed price?
Most often as staff augmentation: our API Platform developers join your team remotely, in a dedicated team overseen by our tech leads, or as targeted reinforcement on a specific skill. For a longer project where Etixio owns the objective and delivery, a time-and-materials project is billed for the time spent. For a short, stable scope, a fixed-price project sets a firm price, deliverables and acceptance criteria.
Let’s talk about your API.
Tell us about the API to build or take over, its consumers and the known constraints. We will review the contract, access rights and the first scope of work with your team.