REST API

Base URL (default prefix):

/{prefix}/api
→ /vgcomments/api

Blade Comments uses this API from the browser. Livewire Comments mostly talks to PHP services directly but shares the same backend rules.

All mutating routes expect a valid web session CSRF token (X-CSRF-TOKEN / _token) when called from your app.

Endpoints

Method	Path	Description
GET	/comments	List comments
POST	/comments	Create comment
PUT	/comments/{uuid}	Update comment
DELETE	/comments/{uuid}	Delete comment
POST	/comments/{uuid}/reactions	Add reaction
DELETE	/comments/{uuid}/reactions	Remove reaction
POST	/comments/{uuid}/report	Report comment
POST	/files	Upload attachment
GET	/files/{uuid}.{extension}	Stream attachment

Typical query / body fields

Comments are scoped by:

• page_id — string key (e.g. blog-42, dashboard)
• and/or morph pair commentable_id + commentable_type (type must be in allowed_commentable_types)

Common create fields:

• content (required, length from config; Markdown supported)
• parent_id (reply target — nested threads use parent_id, not only the root)
• root_id (thread root when replying)
• Guest: author_name, author_email, author_url when allow_guests is true
• attachments (file metadata from prior /files uploads — chip path)
• recaptcha_token when reCAPTCHA is enabled

List endpoints support ordering (e.g. latest) and pagination. Replies for a root are loaded flat by root_id and nested into a parent_id tree for display.

Reactions

POST   /comments/{uuid}/reactions   body: { "type": "👍" }
DELETE /comments/{uuid}/reactions   body: { "type": "👍" }

type is required, string, min 1 / max 32. Any Unicode emoji is allowed; config('vgcomment.reaction_types') is UI hints only.

File streaming

Uploaded files are not always public disk URLs. Use:

GET /{prefix}/files/{uuid}.{extension}

Custom frontends

You can skip both UI packages and build your own client against this API. Still install vgcomments, publish assets only if you need the admin UI, and migrate.