Laravel array\_keys Validation Rule (Laravel 13.24) | Mohamed Said [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://msaied.com) [ Home ](https://msaied.com) [ Projects ](https://msaied.com/projects) [ Articles ](https://msaied.com/articles) [ Certificates ](https://msaied.com/certificates) [ Contact ](https://msaied.com#contact-section) [ ](https://github.com/EG-Mohamed) [ Home ](https://msaied.com) [ Projects ](https://msaied.com/projects) [ Articles ](https://msaied.com/articles) [ Certificates ](https://msaied.com/certificates) [ Contact ](https://msaied.com#contact-section) [ home ](https://msaied.com) [ articles ](https://msaied.com/articles) Reject Unexpected Array Keys with Laravel Validation (Laravel 13.24) On this page 1. [ The Problem with Silent Filter Failures ](#the-problem-with-silent-filter-failures) 2. [ Basic Usage ](#basic-usage) 3. [ Why Not array:key\_1,key\_2? ](#why-not-codearraykey-1key-2code) 4. [ Custom Messages with :unexpected ](#custom-messages-with-codeunexpectedcode) 5. [ Real-World Example: Filtered Index Endpoint ](#real-world-example-filtered-index-endpoint) 6. [ Validating a JSON Column on Writes ](#validating-a-json-column-on-writes) 7. [ Key Behaviours to Know ](#key-behaviours-to-know) ![Reject Unexpected Array Keys with Laravel Validation (Laravel 13.24)](https://cdn.msaied.com/521/93f8f75335e1366269b4971f40fff6ad.png) [ Laravel ](https://msaied.com/articles?category=laravel) [ Tips & Tricks ](https://msaied.com/articles?category=tips-tricks) #Laravel #Validation #Laravel 13 #Form Request #API Reject Unexpected Array Keys with Laravel Validation (Laravel 13.24) ====================================================================== 5 Aug 2026 3 min read ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said Table of contents 1. [ 01 The Problem with Silent Filter Failures ](#the-problem-with-silent-filter-failures) 2. [ 02 Basic Usage ](#basic-usage) 3. [ 03 Why Not array:key\_1,key\_2? ](#why-not-codearraykey-1key-2code) 4. [ 04 Custom Messages with :unexpected ](#custom-messages-with-codeunexpectedcode) 5. [ 05 Real-World Example: Filtered Index Endpoint ](#real-world-example-filtered-index-endpoint) 6. [ 06 Validating a JSON Column on Writes ](#validating-a-json-column-on-writes) 7. [ 07 Key Behaviours to Know ](#key-behaviours-to-know) The Problem with Silent Filter Failures --------------------------------------- Endpoints that accept a bag of options have a subtle failure mode: a client sends `?filter[stat us]=draft` with a typo, your code reads `$filters['status']`, finds nothing, and returns the full unfiltered list. No error is raised, the response looks correct, and the bug surfaces later as an intermittent mystery. Laravel 13.24 ships the `array_keys` validation rule to close this gap. It lets you declare exactly which keys an array may contain and returns a failure message that names what went wrong. Basic Usage ----------- Both the fluent builder and the string form are supported: ```php use Illuminate\Validation\Rule; $request->validate([ 'filter' => Rule::arrayKeys(['status', 'author', 'tag']), ]); // Equivalent string form $request->validate([ 'filter' => 'array_keys:status,author,tag', ]); ``` Given `['status' => 'draft', 'stat us' => 'draft']`, validation fails with: > The filter field must only contain the following keys: status, author, tag. The keys are **permitted, not required**. To enforce that specific keys must also be present, compose the rule with `required_array_keys`: ```php 'coordinates' => [ 'required_array_keys:lat,lng', Rule::arrayKeys(['lat', 'lng']), ], ``` Why Not `array:key_1,key_2`? ---------------------------- `Rule::array()` has accepted a key list for a while, but it conflates two concerns — type checking and key checking — into one message: | Rule | Message on unexpected key | |---|---| | `array:status,author` | The filter field must be an array. | | `array_keys:status,author` | The filter field must only contain the following keys: status, author. | The first message is misleading when the value *is* an array. The new rule separates the concerns and reports them independently in `$validator->failed()` as `Array` and `ArrayKeys`. Custom Messages with `:unexpected` ---------------------------------- The rule ships two placeholders: `:values` (the allowed keys) and `:unexpected` (the keys that caused the failure). The `:unexpected` placeholder is especially useful in API responses: ```php $request->validate( ['filter' => Rule::arrayKeys(['status', 'author', 'tag'])], ['filter.array_keys' => 'The :attribute field may not contain :unexpected.'], ); // The filter field may not contain colour, sort. ``` Real-World Example: Filtered Index Endpoint ------------------------------------------- ```php class IndexPostRequest extends FormRequest { public function rules(): array { return [ 'filter' => ['sometimes', 'array', Rule::arrayKeys(['status', 'author', 'tag'])], 'filter.status' => ['sometimes', Rule::enum(PostStatus::class)], 'filter.author' => ['sometimes', 'integer', 'exists:users,id'], 'filter.tag' => ['sometimes', 'string', 'max:50'], 'sort' => ['sometimes', 'string', Rule::in(['title', '-title', 'published_at', '-published_at'])], ]; } public function messages(): array { return [ 'filter.array_keys' => 'Unknown filter: :unexpected. Allowed filters are :values.', ]; } } ``` Anything that reaches the controller is a key you explicitly named, so defensive `isset` checks become unnecessary. Validating a JSON Column on Writes ---------------------------------- The rule is equally useful when persisting a settings or preferences column: ```php 'preferences' => ['sometimes', 'array', Rule::arrayKeys(['theme', 'timezone', 'digest_frequency'])], 'preferences.theme' => ['sometimes', Rule::in(['light', 'dark', 'system'])], 'preferences.timezone' => ['sometimes', 'timezone'], 'preferences.digest_frequency' => ['sometimes', Rule::in(['daily', 'weekly', 'never'])], ``` A renamed frontend field now fails loudly during deployment instead of silently writing a stale key into every row. Key Behaviours to Know ---------------------- - **A non-array value fails the rule.** Pair with `array` so the type failure gets its own message. - **At least one key is required.** Passing no keys throws an `InvalidArgumentException` at runtime. Use `prohibited` if you want to block the field entirely. - **Accepts any `Arrayable`.** Collections and backed enums both work: `Rule::arrayKeys(FilterKey::cases())`. - **Variadic form is supported.** `Rule::arrayKeys('status', 'author')` is equivalent to passing an array. The rule was contributed by [@nebarg](https://github.com/nebarg) in [\#60918](https://github.com/laravel/framework/pull/60918). --- *Source: [Reject Unexpected Array Keys with Laravel Validation — Laravel News](https://laravel-news.com/laravel-array-keys-validation-rule)* Found this useful? [ ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fmsaied.com%2Farticles%2Freject-unexpected-array-keys-with-laravel-validation-laravel-1324&text=Reject+Unexpected+Array+Keys+with+Laravel+Validation+%28Laravel+13.24%29) [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fmsaied.com%2Farticles%2Freject-unexpected-array-keys-with-laravel-validation-laravel-1324) Frequently Asked Questions ---------------------------- 3 questions Q01 What is the difference between `array:key\_1,key\_2` and `array\_keys:key\_1,key\_2` in Laravel validation? Both reject unexpected keys, but `array` reports a single ambiguous message ('must be an array') even when the value is already an array. `array_keys` reports a dedicated message that names the allowed keys, and the two rules fail independently in `$validator->failed()` so you can handle each case separately. Q02 Does the `array\_keys` rule require all listed keys to be present? No. It only constrains which keys *may* appear; it does not require any of them. To also enforce presence, combine it with `required_array_keys`: `['required_array_keys:lat,lng', Rule::arrayKeys(['lat', 'lng'])]`. Q03 How can I show the client exactly which unexpected key failed validation? Use the `:unexpected` placeholder in a custom message: `'filter.array_keys' => 'The :attribute field may not contain :unexpected.'`. This tells the client the exact key name rather than just the list of allowed keys. Continue reading More Articles --------------- [ View all ](https://msaied.com/articles) [ ![Saga Lara Flow: Durable Workflows and Compensating Transactions on Laravel Queues](https://cdn.msaied.com/520/d77bd3c0cecb6fb89c16f85648e7e369.png) Laravel Workflows Saga Pattern ### Saga Lara Flow: Durable Workflows and Compensating Transactions on Laravel Queues Saga Lara Flow is a Laravel package that lets you write long-running business processes as plain PHP methods o... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 7 Aug 2026 4 min read Read ](https://msaied.com/articles/saga-lara-flow-durable-workflows-and-compensating-transactions-on-laravel-queues) [ ![Filament v4.12 & v5.7: Major Performance Improvements and Security Patches](https://cdn.msaied.com/518/48e5a4da1b38d6cf27a0117baa547e1b.png) Filament Laravel Performance ### Filament v4.12 & v5.7: Major Performance Improvements and Security Patches Filament v4.12.6 and v5.7.6 ship massive rendering speed gains—up to 92% faster form fields—alongside security... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 6 Aug 2026 1 min read Read ](https://msaied.com/articles/filament-v412-v57-major-performance-improvements-and-security-patches) [ ![Managed Queues: Autoscaling Queue Workers on Laravel Cloud](https://cdn.msaied.com/519/854099015015dbc72dd8743202b69efc.png) Laravel Cloud Queue Workers Autoscaling ### Managed Queues: Autoscaling Queue Workers on Laravel Cloud Laravel Cloud's managed queues feature autoscales workers based on queue pressure, surfaces failed jobs in a r... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 6 Aug 2026 3 min read Read ](https://msaied.com/articles/managed-queues-autoscaling-queue-workers-on-laravel-cloud) [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://msaied.com)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. Explore - [Home](https://msaied.com) - [Projects](https://msaied.com/projects) - [Articles](https://msaied.com/articles) - [Certificates](https://msaied.com/certificates) - [Contact](https://msaied.com#contact-section) Connect - [ hello@msaied.com ](mailto:hello@msaied.com) - [ +20 109 461 9204 ](tel:+201094619204) © 2026 Mohamed Said. All rights reserved. [ ](https://github.com/EG-Mohamed) [ ](https://www.linkedin.com/in/msaiedm/) [ ](https://wa.me/201094619204) [ ](mailto:hello@msaied.com) [ ](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view)