Laravel Validation Rules: six validation rules Spatie adds to the framework

Six rules, all of them things you would otherwise write yourself

The scope is small on purpose. The package contains six rules for Laravel validation, listed as Authorized, CountryCode, Currency, Enum, ModelsExist and Delimited. Each one exists because the framework gives you the extension points but not the glue, and the README's own description of the package is a set of useful Laravel validation rules. Installation is one Composer command, and the package registers itself without any provider wiring:

composer require spatie/laravel-validation-rules

The rules are used the way you would expect in a FormRequest, as objects placed in the rules array alongside the built-in strings such as required. If you want to change the wording of the failure messages, the README explains that the translations can be published into your own resources/lang folder with a vendor publish command:

php artisan vendor:publish --provider="Spatie\ValidationRules\ValidationRulesServiceProvider"

Authorized runs a policy check as part of validation

The Authorized rule is the one that goes furthest beyond a type check. It determines whether the current user is allowed to perform an ability on an instance of a given model, where the model id is the field under validation. In practice it takes an ability name and a model class, and it resolves the model from the request before asking the policy. The rule passes when the policy allows the action, for example when the model belongs to the logged in user:

use Spatie\ValidationRules\Rules\Authorized;

public function rules()
{
    return [
        'model_id' => [new Authorized('edit', TestModel::class)],
    ];
}

A third parameter takes an authentication guard name, which matters for applications that use more than one guard, since without it the rule uses the default guard. Model resolution respects the getRouteKeyName method on your model, so a custom route key works without extra configuration.

CountryCode and Currency depend on an external code list package

The two ISO rules check against published code lists, and both need the league/iso3166 package installed. The README is explicit about it, with the note that this rule requires the package league/iso3166 to be installed and the command composer require league/iso3166. CountryCode checks a two letter ISO3166 country code such as GB, DK or NL, and it has a nullable() variant so that null and zero are accepted as well, which is the pattern to use when the field may be empty. Currency checks a three letter ISO4217 currency code such as EUR, USD or CAD, and the README points at the Laravel documentation on implicit rules for the case where the field should not be required. One documentation detail is worth flagging: the Currency section also names league/iso3166 as its dependency, which reads like a copy of the paragraph above it rather than a deliberate choice, so check the package manifest before installing both.

Enum assumes a static toArray, not a native PHP enum

The Enum rule validates that the value under validation is one of the values an enum class allows, and it makes an assumption about how the enum exposes them. The README states that the rule assumes the enum class has a static toArray method returning all valid values, and it points at spatie/enum or myclabs/php-enum as good choices, showing an example class that extends MyCLabs\Enum\Enum with ADMIN and REVIEWER constants. The rule then takes the class name:

use Spatie\ValidationRules\Rules\Enum;

public function rules()
{
    return [
        'role' => [new Enum(UserRole::class)],
    ];
}

Because the contract is a static toArray rather than the PHP 8.1 backed enumeration, a native backed enum will not satisfy it as written. That is the single largest compatibility constraint in the package and the one to check first if your project is on a recent PHP.

ModelsExist checks an array of records, by id or by any attribute

ModelsExist validates that every value in an input array exists as an attribute of the given model class. By default it assumes the id attribute, so an array of model ids paired with the array rule covers the common case of a list of checkboxes or multi-select input. The second argument lets you validate a different attribute, and the README's example checks a list of user emails, which is the pattern for forms that accept free text values that have to resolve to records. The rule is deliberately about existence rather than ownership or authorisation, so a separate Authorized check is still needed if the records should also belong to the current user. The last rule in the set, Delimited, validates a string containing delimited values, with the constructor taking another rule that is applied to each separated value.

Maintenance and the shape of the package

The repository is not archived and the last push was on 2026-06-02, with tagged releases 3.4.4 on 2026-02-21, 3.4.3 on 2025-02-25 and 3.4.2 on 2025-02-24. The release cadence is therefore roughly yearly for patch releases, which fits a package whose feature set is stable. The licence is MIT with the licence file at the repository root, and there is an UPGRADING.md alongside the CHANGELOG.md for anyone moving between major versions. The root listing shows a conventional package layout with src/ holding the rules, resources/ holding the translations, tests/ with a phpunit configuration, a database directory for the fixtures the tests need, and a composer.json for the package metadata. The homepage is the Spatie open source page rather than a documentation site of its own, so the README is the primary documentation and it stops at the point where each rule's example is given.

Editorial conclusion

The package suits a Laravel team that keeps its validation in FormRequest objects and would otherwise hand write the same six rules, since each one here is a few lines of framework glue you would write anyway. It does not suit a project that needs deeper validation logic, since the rules are deliberately narrow, and the CountryCode and Currency rules pull in an extra package for the code lists. Before adopting, check that league/iso3166 is acceptable as a dependency, and remember that the Enum rule assumes your enum class exposes a static toArray method rather than relying on PHP 8.1 native enums.

Frequently asked questions

Official sources

1. License: MIT
2. Project website
3. README
4. Releases
5. spatie/laravel-validation-rules on GitHub