Build a JSON-RPC 2.0 API in Symfony in 15 minutes: from composer require to OpenAPI

REST works great while your API describes resources. But as soon as the domain becomes verb-shaped - recalculateInvoice , mergeAccounts , assignTask - you end up bending verbs into nouns and arguing about which HTTP method cancels an order. JSON-RPC 2.0 cuts through all of that: every call is just method + params , one endpoint, a spec that fits on two pages, and batching out of the box. In this article we will build a working JSON-RPC 2.0 API on Symfony: a task tracker with DTO validation, batch requests and generated OpenAPI documentation. There is surprisingly little code to write: methods are declared with attributes, validation is derived from property types, and Swagger is generated by a console command. Everything below lives as a ready-to-run project on GitHub: symfony-jsonrpc-api-demo - clone it and poke it with curl while you read. We will use the otezvikentiy/json-rpc-api bundle (PHP 8.2-8.5, Symfony 6.4/7/8; this article uses PHP 8.4 and Symfony 7.4). Full disclosure: I am the author of the bundle. It has been running in production for three years - internal fintech tooling, an HRM system - nothing glamorous load-wise, but the correctness, logging and audit requirements were real, and they shaped most of what you will see below. Installation composer create-project symfony/skeleton: "7.4.*" tasks-api cd tasks-api composer require otezvikentiy/json-rpc-api If Flex has contrib recipes enabled, the bundle registers itself. If not, it is two lines by hand: // config/bundles.php return [ // ... OV\JsonRPCAPIBundle\OVJsonRPCAPIBundle :: class => [ 'all' => true ], ]; Wire up the route and a minimal config: # config/routes/ov_json_rpc_api.yaml ov_json_rpc_api : resource : ' @OVJsonRPCAPIBundle/config/routes/routes.yaml' # config/packages/ov_json_rpc_api.yaml ov_json_rpc_api : access_control_allow_origin_list : - ' http://localhost:8000' The bundle registers a single route, /api/v{version} - every request goes through it. Note the CORS list format: these are ful