Calling a Third-Party REST API from PHP

Send bounded HTTPS requests and validate response status and schema. The examples separate the essential operation from the conditions a production implementation must enforce.

What It Does

Send bounded HTTPS requests and validate response status and schema.

Prerequisites

Use a dedicated development environment with test accounts and records. Separate authorization, validation and error handling from response formatting; never copy demonstration-only secrets into production.

Example 1: Core Behavior

This scenario applies the exact rule described in the guide, with controlled sample values.

<?php
$headers=["Accept: application/json"]; $timeout=4;
if ($timeout<1) throw new RuntimeException("Timeout required"); echo json_encode($headers);

Example 2: Alternative or Failure Case

This scenario applies the exact rule described in the guide, with controlled sample values.

<?php
$status=429; $retryAfter=5; echo $status===429?"Wait ".$retryAfter." seconds":"Continue";

Practical Example: Applying the Rule

This practical workflow performs the relevant operation, with strict error checks. Configure the required transport or database driver before running it.

<?php
$endpoint = 'https://api.example.test/products/42';
$ch = curl_init($endpoint);
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 8, CURLOPT_CONNECTTIMEOUT => 3, CURLOPT_FOLLOWLOCATION => false]);
$body = curl_exec($ch);
if ($body === false) throw new RuntimeException('Transport error code: ' . curl_errno($ch));
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
if ($status < 200 || $status >= 300) throw new RuntimeException('Upstream status ' . $status);
$data = json_decode($body, true, 512, JSON_THROW_ON_ERROR);
if (!is_array($data) || !isset($data['id'])) throw new UnexpectedValueException('Unexpected API schema');
echo 'Product ID: ' . $data['id'];

Important Behavior and Edge Cases

Do not forward arbitrary client-controlled URLs because it creates SSRF risk.

Comparison with Related Functions or Patterns

Common Beginner Mistakes

Key Takeaways

• Send bounded HTTPS requests and validate response status and schema.
• Do not forward arbitrary client-controlled URLs because it creates SSRF risk.
• Guzzle provides a higher-level alternative to native cURL.

Select this API or pattern based on its documented behavior and the trust boundaries in your own application, and test all external integrations against their actual deployments.