README

This repository contains a client library for LaunchDarkly's REST API. This client was automatically generated from our OpenAPI specification using a code generation library.

This REST API is for custom integrations, data export, or automating your feature flag workflows. DO NOT use this client library to include feature flags in your web or mobile application. To integrate feature flags with your application, read the SDK documentation.

This client library is only compatible with the latest version of our REST API, version 20220603. Previous versions of this client library, prior to version 10.0.0, are only compatible with earlier versions of our REST API. When you create an access token, you can set the REST API version associated with the token. By default, API requests you send using the token will use the specified API version. To learn more, read Versioning.

OpenAPIClient-php

Overview

Authentication

LaunchDarkly's REST API uses the HTTPS protocol with a minimum TLS version of 1.2.

All REST API resources are authenticated with either personal or service access tokens, or session cookies. Other authentication mechanisms are not supported. You can manage personal access tokens on your Authorization page in the LaunchDarkly UI.

LaunchDarkly also has SDK keys, mobile keys, and client-side IDs that are used by our server-side SDKs, mobile SDKs, and JavaScript-based SDKs, respectively. These keys cannot be used to access our REST API. These keys are environment-specific, and can only perform read-only operations such as fetching feature flag settings.

Keep your access tokens and SDK keys private

Access tokens should never be exposed in untrusted contexts. Never put an access token in client-side JavaScript, or embed it in a mobile application. LaunchDarkly has special mobile keys that you can embed in mobile apps. If you accidentally expose an access token or SDK key, you can reset it from your Authorization page.

The client-side ID is safe to embed in untrusted contexts. It's designed for use in client-side JavaScript.

Authentication using request header

The preferred way to authenticate with the API is by adding an Authorization header containing your access token to your requests. The value of the Authorization header must be your access token.

Manage personal access tokens from the Authorization page.

Authentication using session cookie

For testing purposes, you can make API calls directly from your web browser. If you are logged in to the LaunchDarkly application, the API will use your existing session to authenticate calls.

If you have a role other than Admin, or have a custom role defined, you may not have permission to perform some API calls. You will receive a 401 response code in that case.

Modifying the Origin header causes an error

LaunchDarkly validates that the Origin header for any API request authenticated by a session cookie matches the expected Origin header. The expected Origin header is https://app.launchdarkly.com.

If the Origin header does not match what's expected, LaunchDarkly returns an error. This error can prevent the LaunchDarkly app from working correctly.

Any browser extension that intentionally changes the Origin header can cause this problem. For example, the Allow-Control-Allow-Origin: * Chrome extension changes the Origin header to http://evil.com and causes the app to fail.

To prevent this error, do not modify your Origin header.

LaunchDarkly does not require origin matching when authenticating with an access token, so this issue does not affect normal API usage.

Representations

All resources expect and return JSON response bodies. Error responses also send a JSON body. To learn more about the error format of the API, read Errors.

In practice this means that you always get a response with a Content-Type header set to application/json.

In addition, request bodies for PATCH, POST, and PUT requests must be encoded as JSON with a Content-Type header set to application/json.

Summary and detailed representations

When you fetch a list of resources, the response includes only the most important attributes of each resource. This is a summary representation of the resource. When you fetch an individual resource, such as a single feature flag, you receive a detailed representation of the resource.

The best way to find a detailed representation is to follow links. Every summary representation includes a link to its detailed representation.

Expanding responses

Sometimes the detailed representation of a resource does not include all of the attributes of the resource by default. If this is the case, the request method will clearly document this and describe which attributes you can include in an expanded response.

To include the additional attributes, append the expand request parameter to your request and add a comma-separated list of the attributes to include. For example, when you append ?expand=members,maintainers to the Get team endpoint, the expanded response includes both of these attributes.

Links and addressability

The best way to navigate the API is by following links. These are attributes in representations that link to other resources. The API always uses the same format for links:

Links to other resources within the API are encapsulated in a _links object
If the resource has a corresponding link to HTML content on the site, it is stored in a special _site link

Each link has two attributes:

An href, which contains the URL
A type, which describes the content type

For example, a feature resource might return the following:

{
  \"_links\": {
    \"parent\": {
      \"href\": \"/api/features\",
      \"type\": \"application/json\"
    },
    \"self\": {
      \"href\": \"/api/features/sort.order\",
      \"type\": \"application/json\"
    }
  },
  \"_site\": {
    \"href\": \"/features/sort.order\",
    \"type\": \"text/html\"
  }
}

From this, you can navigate to the parent collection of features by following the parent link, or navigate to the site page for the feature by following the _site link.

Collections are always represented as a JSON object with an items attribute containing an array of representations. Like all other representations, collections have _links defined at the top level.

Paginated collections include first, last, next, and prev links containing a URL with the respective set of elements in the collection.

Updates

Resources that accept partial updates use the PATCH verb. Most resources support the JSON patch format. Some resources also support the JSON merge patch format, and some resources support the semantic patch format, which is a way to specify the modifications to perform as a set of executable instructions. Each resource supports optional comments that you can submit with updates. Comments appear in outgoing webhooks, the audit log, and other integrations.

When a resource supports both JSON patch and semantic patch, we document both in the request method. However, the specific request body fields and descriptions included in our documentation only match one type of patch or the other.

Updates using JSON patch

JSON patch is a way to specify the modifications to perform on a resource. JSON patch uses paths and a limited set of operations to describe how to transform the current state of the resource into a new state. JSON patch documents are always arrays, where each element contains an operation, a path to the field to update, and the new value.

For example, in this feature flag representation:

{
    \"name\": \"New recommendations engine\",
    \"key\": \"engine.enable\",
    \"description\": \"This is the description\",
    ...
}

You can change the feature flag's description with the following patch document:

[{ \"op\": \"replace\", \"path\": \"/description\", \"value\": \"This is the new description\" }]

You can specify multiple modifications to perform in a single request. You can also test that certain preconditions are met before applying the patch:

[
  { \"op\": \"test\", \"path\": \"/version\", \"value\": 10 },
  { \"op\": \"replace\", \"path\": \"/description\", \"value\": \"The new description\" }
]

The above patch request tests whether the feature flag's version is 10, and if so, changes the feature flag's description.

Attributes that are not editable, such as a resource's _links, have names that start with an underscore.

Updates using JSON merge patch

JSON merge patch is another format for specifying the modifications to perform on a resource. JSON merge patch is less expressive than JSON patch. However, in many cases it is simpler to construct a merge patch document. For example, you can change a feature flag's description with the following merge patch document:

{
  \"description\": \"New flag description\"
}

Updates using semantic patch

Some resources support the semantic patch format. A semantic patch is a way to specify the modifications to perform on a resource as a set of executable instructions.

Semantic patch allows you to be explicit about intent using precise, custom instructions. In many cases, you can define semantic patch instructions independently of the current state of the resource. This can be useful when defining a change that may be applied at a future date.

To make a semantic patch request, you must append domain-model=launchdarkly.semanticpatch to your Content-Type header.

Here's how:

Content-Type: application/json; domain-model=launchdarkly.semanticpatch

If you call a semantic patch resource without this header, you will receive a 400 response because your semantic patch will be interpreted as a JSON patch.

The body of a semantic patch request takes the following properties:

comment (string): (Optional) A description of the update.
environmentKey (string): (Required for some resources only) The environment key.
instructions (array): (Required) A list of actions the update should perform. Each action in the list must be an object with a kind property that indicates the instruction. If the instruction requires parameters, you must include those parameters as additional fields in the object. The documentation for each resource that supports semantic patch includes the available instructions and any additional parameters.

For example:

{
  \"comment\": \"optional comment\",
  \"instructions\": [ {\"kind\": \"turnFlagOn\"} ]
}

Semantic patches are not applied partially; either all of the instructions are applied or none of them are. If any instruction is invalid, the endpoint returns an error and will not change the resource. If all instructions are valid, the request succeeds and the resources are updated if necessary, or left unchanged if they are already in the state you request.

Updates with comments

You can submit optional comments with PATCH changes.

To submit a comment along with a JSON patch document, use the following format:

{
  \"comment\": \"This is a comment string\",
  \"patch\": [{ \"op\": \"replace\", \"path\": \"/description\", \"value\": \"The new description\" }]
}

To submit a comment along with a JSON merge patch document, use the following format:

{
  \"comment\": \"This is a comment string\",
  \"merge\": { \"description\": \"New flag description\" }
}

To submit a comment along with a semantic patch, use the following format:

{
  \"comment\": \"This is a comment string\",
  \"instructions\": [ {\"kind\": \"turnFlagOn\"} ]
}

Errors

The API always returns errors in a common format. Here's an example:

{
  \"code\": \"invalid_request\",
  \"message\": \"A feature with that key already exists\",
  \"id\": \"30ce6058-87da-11e4-b116-123b93f75cba\"
}

The code indicates the general class of error. The message is a human-readable explanation of what went wrong. The id is a unique identifier. Use it when you're working with LaunchDarkly Support to debug a problem with a specific API call.

HTTP status error response codes

CORS

The LaunchDarkly API supports Cross Origin Resource Sharing (CORS) for AJAX requests from any origin. If an Origin header is given in a request, it will be echoed as an explicitly allowed origin. Otherwise the request returns a wildcard, Access-Control-Allow-Origin: *. For more information on CORS, read the CORS W3C Recommendation. Example CORS headers might look like:

Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization
Access-Control-Allow-Methods: OPTIONS, GET, DELETE, PATCH
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 300

You can make authenticated CORS calls just as you would make same-origin calls, using either token or session-based authentication. If you are using session authentication, you should set the withCredentials property for your xhr request to true. You should never expose your access tokens to untrusted entities.

Rate limiting

We use several rate limiting strategies to ensure the availability of our APIs. Rate-limited calls to our APIs return a 429 status code. Calls to our APIs include headers indicating the current rate limit status. The specific headers returned depend on the API route being called. The limits differ based on the route, authentication mechanism, and other factors. Routes that are not rate limited may not contain any of the headers described below.

Rate limiting and SDKs

LaunchDarkly SDKs are never rate limited and do not use the API endpoints defined here. LaunchDarkly uses a different set of approaches, including streaming/server-sent events and a global CDN, to ensure availability to the routes used by LaunchDarkly SDKs.

Global rate limits

Authenticated requests are subject to a global limit. This is the maximum number of calls that your account can make to the API per ten seconds. All service and personal access tokens on the account share this limit, so exceeding the limit with one access token will impact other tokens. Calls that are subject to global rate limits may return the headers below:

We do not publicly document the specific number of calls that can be made globally. This limit may change, and we encourage clients to program against the specification, relying on the two headers defined above, rather than hardcoding to the current limit.

Route-level rate limits

Some authenticated routes have custom rate limits. These also reset every ten seconds. Any service or personal access tokens hitting the same route share this limit, so exceeding the limit with one access token may impact other tokens. Calls that are subject to route-level rate limits return the headers below:

A route represents a specific URL pattern and verb. For example, the Delete environment endpoint is considered a single route, and each call to delete an environment counts against your route-level rate limit for that route.

We do not publicly document the specific number of calls that an account can make to each endpoint per ten seconds. These limits may change, and we encourage clients to program against the specification, relying on the two headers defined above, rather than hardcoding to the current limits.

IP-based rate limiting

We also employ IP-based rate limiting on some API routes. If you hit an IP-based rate limit, your API response will include a Retry-After header indicating how long to wait before re-trying the call. Clients must wait at least Retry-After seconds before making additional calls to our API, and should employ jitter and backoff strategies to avoid triggering rate limits again.

OpenAPI (Swagger) and client libraries

We have a complete OpenAPI (Swagger) specification for our API.

We auto-generate multiple client libraries based on our OpenAPI specification. To learn more, visit the collection of client libraries on GitHub. You can also use this specification to generate client libraries to interact with our REST API in your language of choice.

Our OpenAPI specification is supported by several API-based tools such as Postman and Insomnia. In many cases, you can directly import our specification to explore our APIs.

Method overriding

Some firewalls and HTTP clients restrict the use of verbs other than GET and POST. In those environments, our API endpoints that use DELETE, PATCH, and PUT verbs are inaccessible.

To avoid this issue, our API supports the X-HTTP-Method-Override header, allowing clients to "tunnel" DELETE, PATCH, and PUT requests using a POST request.

For example, to call a PATCH endpoint using a POST request, you can include X-HTTP-Method-Override:PATCH as a header.

Beta resources

We sometimes release new API resources in beta status before we release them with general availability.

Resources that are in beta are still undergoing testing and development. They may change without notice, including becoming backwards incompatible.

We try to promote resources into general availability as quickly as possible. This happens after sufficient testing and when we're satisfied that we no longer need to make backwards-incompatible changes.

We mark beta resources with a "Beta" callout in our documentation, pictured below:

This feature is in beta

To use this feature, pass in a header including the LD-API-Version key with value set to beta. Use this header with each call. To learn more, read Beta resources.

Resources that are in beta are still undergoing testing and development. They may change without notice, including becoming backwards incompatible.

Using beta resources

To use a beta resource, you must include a header in the request. If you call a beta resource without this header, you receive a 403 response.

Use this header:

LD-API-Version: beta

Federal environments

The version of LaunchDarkly that is available on domains controlled by the United States government is different from the version of LaunchDarkly available to the general public. If you are an employee or contractor for a United States federal agency and use LaunchDarkly in your work, you likely use the federal instance of LaunchDarkly.

If you are working in the federal instance of LaunchDarkly, the base URI for each request is https://app.launchdarkly.us. In the "Try it" sandbox for each request, click the request path to view the complete resource path for the federal environment.

To learn more, read LaunchDarkly in federal environments.

Versioning

We try hard to keep our REST API backwards compatible, but we occasionally have to make backwards-incompatible changes in the process of shipping new features. These breaking changes can cause unexpected behavior if you don't prepare for them accordingly.

Updates to our REST API include support for the latest features in LaunchDarkly. We also release a new version of our REST API every time we make a breaking change. We provide simultaneous support for multiple API versions so you can migrate from your current API version to a new version at your own pace.

Setting the API version per request

You can set the API version on a specific request by sending an LD-API-Version header, as shown in the example below:

LD-API-Version: 20240415

The header value is the version number of the API version you would like to request. The number for each version corresponds to the date the version was released in yyyymmdd format. In the example above the version 20240415 corresponds to April 15, 2024.

Setting the API version per access token

When you create an access token, you must specify a specific version of the API to use. This ensures that integrations using this token cannot be broken by version changes.

Tokens created before versioning was released have their version set to 20160426, which is the version of the API that existed before the current versioning scheme, so that they continue working the same way they did before versioning.

If you would like to upgrade your integration to use a new API version, you can explicitly set the header described above.

Best practice: Set the header for every client or integration

We recommend that you set the API version header explicitly in any client or integration you build.

Only rely on the access token API version during manual testing.

API version changelog

To learn more about how EOL is determined, read LaunchDarkly's End of Life (EOL) Policy.

For more information, please visit https://support.launchdarkly.com.

Installation & Usage

Requirements

PHP 7.4 and later. Should also work with PHP 8.0.

Composer

To install the bindings via Composer, add the following to composer.json:

{
  "repositories": [
    {
      "type": "vcs",
      "url": "https://github.com/launchdarkly/api-client-php.git"
    }
  ],
  "require": {
    "launchdarkly/api-client-php": "*@dev"
  }
}

Then run composer install

Manual Installation

Download the files and include autoload.php:

<?php
require_once('/path/to/OpenAPIClient-php/vendor/autoload.php');

Getting Started

Please follow the installation procedure and then run the following:

<?php
require_once(__DIR__ . '/vendor/autoload.php');



// Configure API key authorization: ApiKey
$config = LaunchDarklyApi\Configuration::getDefaultConfiguration()->setApiKey('Authorization', 'YOUR_API_KEY');
// Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
// $config = LaunchDarklyApi\Configuration::getDefaultConfiguration()->setApiKeyPrefix('Authorization', 'Bearer');


$apiInstance = new LaunchDarklyApi\Api\AccessTokensApi(
    // If you want use custom http client, pass your client which implements `GuzzleHttp\ClientInterface`.
    // This is optional, `GuzzleHttp\Client` will be used as default.
    new GuzzleHttp\Client(),
    $config
);
$id = 'id_example'; // string | The ID of the access token to update

try {
    $apiInstance->deleteToken($id);
} catch (Exception $e) {
    echo 'Exception when calling AccessTokensApi->deleteToken: ', $e->getMessage(), PHP_EOL;
}

API Endpoints

All URIs are relative to https://app.launchdarkly.com

Models

Authorization

ApiKey

Type: API key
API key parameter name: Authorization
Location: HTTP header

Tests

To run the tests, use:

composer install
vendor/bin/phpunit

Author

support@launchdarkly.com

About this package

This PHP package is automatically generated by the OpenAPI Generator project:

API version: 2.0
- Package version: 17.1.0
Build package: org.openapitools.codegen.languages.PhpClientCodegen

launchdarkly / api-client-php

Maintainers

Details