Voyti

REST API

The JSON REST API for user management ships as a separate package, yiirocks/voyti-api. It adds the voyti-routes-api config group, Bearer-token authentication on top of core's IdentityAdapter, and two console commands for issuing and revoking API tokens. It reuses core's models, services, and administratorPermissionName permission check.

Installation

Routes are not auto-registered. Pull the voyti-routes-api config group into your router and mount it at whatever prefix you like:

use Yiisoft\Config\Config;
use Yiisoft\Definitions\DynamicReference;
use Yiisoft\Router\Group;
use Yiisoft\Router\RouteCollection;
use Yiisoft\Router\RouteCollectionInterface;
use Yiisoft\Router\RouteCollector;

/** @var Config $config */

return [
    RouteCollectionInterface::class => [
        'class' => RouteCollection::class,
        '__construct()' => [
            'collector' => DynamicReference::to(
                static fn() => (new RouteCollector())
                    ->addRoute(
                        Group::create('/user/api/')
                            ->routes(...$config->get('voyti-routes-api')),
                    )
            ),
        ],
    ],
];

The group wraps itself with its own middleware (JsonDataResponseMiddleware, plus ApiTokenAuthenticationMiddleware and AccessRuleMiddleware on the v1/ routes), so nothing else needs wiring.

Configuration

// config/params.php
return [
    'yiirocks/voyti-api' => [
        'apiTokenLifespan' => 3600,
    ],
];

Authentication

Requests authenticate with an Authorization: Bearer <token> header, not the web session/CSRF cookie. ApiTokenAuthenticationMiddleware resolves the token to a user for that request only and returns 401 when the header is missing or the token is invalid or expired. AccessRuleMiddleware then enforces administratorPermissionName as usual, so API tokens only grant what that permission grants.

Managing tokens

The package registers two console commands under yiisoft/yii-console:

Command	Description
voyti:api-token:generate	Generate a REST API access token for a user (printed once)
voyti:api-token:revoke	Revoke all REST API access tokens for a user

Endpoints