Validating Array Input in Laravel

Laravel's validator handles array input using dot notation to reach into nested structures — the same rule syntax as any other field, applied to each array element via a wildcard.

Validating a fixed-shape array

// Input: ['address' => ['street' => '...', 'city' => '...']]
$request->validate([
    'address.street' => ['required', 'string'],
    'address.city' => ['required', 'string'],
]);

Validating every item in a list with the * wildcard

// Input: ['emails' => ['a@example.com', 'b@example.com']]
$request->validate([
    'emails' => ['required', 'array', 'min:1'],
    'emails.*' => ['required', 'email'],
]);

The rule on the array itself (emails) validates the array as a whole — that it exists and has at least one item. The emails.* rule applies to every individual element inside it, so each email in the list is validated independently.

A list of objects — the common "dynamic form rows" case

// Input: ['items' => [['name' => 'Widget', 'qty' => 2], ['name' => 'Gadget', 'qty' => 1]]]
$request->validate([
    'items' => ['required', 'array', 'min:1'],
    'items.*.name' => ['required', 'string'],
    'items.*.qty' => ['required', 'integer', 'min:1'],
]);

This is the pattern for a form where a user can add multiple rows dynamically (order line items, multiple contacts) — each row's fields are validated the same way regardless of how many rows were actually submitted.

Custom error messages for array items

$request->validate([
    'emails.*' => ['required', 'email'],
], [
    'emails.*.email' => 'One of the emails you entered is not valid.',
]);

Laravel doesn't tell you which specific index failed in the default error message — for a form where that matters to the user, you may need to check $errors for keys like emails.0, emails.1 and map them back to the specific row in the UI yourself.

Rejecting unexpected extra fields

By default, extra keys not listed in the validation rules are silently allowed through in the request but not included in $request->validated() — if you need to actively reject unexpected fields rather than just ignore them, that requires an explicit check beyond the standard validation rules.