Validate before the controller works
ApiRequest uses Validator rules and produces a validation exception translated to a 422 response with field errors.
return ApiResponse::success([
'data' => MovieResource::collection($movies),
]);Return a resource, not an entity
A resource can rename fields, format dates, hide secrets, and add links. This becomes the stable public contract even if the entity changes.
Keep errors stable
Clients should be able to handle an error code and message consistently. Debug details appear only when explicitly enabled.