PHP: what it is and what it is used for

A customer opens /api/orders/{orderUuid}. Using a trusted identity, the application determines who made the request and, from the public UUID, loads only an order the customer is allowed to access. Only then does it prepare a JSON response; it does not return a database row directly to the browser without checking it.

The example deliberately shows only the HTTP layer. In a real application, loading the order and checking access rely on an application service that knows the system rules. It should return the same safe outcome for an order that does not exist and one the customer may not access, so the API does not reveal its existence. The important order is: identity and permission first, then data, and only then the response.

PHP

public function detail(
    string $orderUuid,
    CurrentUser $currentUser,
    OrderService $orders,
): JsonResponse {
    $order = $orders->getForCustomer(
        orderUuid: $orderUuid,
        customerId: $currentUser->id(),
    );

    return new JsonResponse([
        'uuid' => $order->uuid()->toString(),
        'status' => $order->status(),
    ]);
}