Return a bounded JSON endpoint

Steps

Authorize in middleware, validate fields in the HTTP adapter, invoke the service, and return JSON through Response.

// Controller fragment; presentation records were already permission-filtered.
return Response::json(['results' => $results]);

For JSON mutations, require the declared Content-Type, reject unexpected keys, bound request bytes, and require a valid browser-session CSRF header. Do not treat an Accept header as authorization.

Verify

Test unsupported media, malformed JSON, arrays where strings are required, unknown fields, missing CSRF, revoked accounts, and safe errors. Read HTTP. The framework's AJAX contract remains a deferred reference, not an automatically enabled application runtime.

Editorial provenance

Source: resources/guides/json-endpoint.md. Source SHA-256: 022502b311297175e089fac2c38e0029a4884df7f6f73f30a48bce1bdb641e40.

Knowledge-base application source; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.