> For the complete documentation index, see [llms.txt](https://core-foundation-doc.rupeshstha.com.np/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://core-foundation-doc.rupeshstha.com.np/http-and-application-layer/requests.md).

# Form Requests

Core Foundation's `BaseRequest` simplifies API validation by enforcing consistency and providing a structured lifecycle for shared rules.

## Rule Hierarchy (The "Shared Rules" Pattern)

Most API resources share 90% of their validation rules between creation and update. `BaseRequest` provides three hooks to eliminate duplication:

1. `baseRules()`: Rules shared by **all** methods.
2. `storeRules()`: Rules added/overridden for **POST** only.
3. `updateRules()`: Rules added/overridden for **PUT/PATCH** only.

### Merging Strategy

The foundation automatically merges these:

* **Store**: `baseRules()` + `storeRules()`
* **Update**: `baseRules()` + `updateRules()`

**Later keys win.** This allows you to define a field as `required` in `baseRules` and relax it to `sometimes` in `updateRules` without rewriting the entire ruleset.

```php
class UserRequest extends BaseRequest
{
    protected function baseRules(): array {
        return ['email' => ['required', 'email']];
    }

    protected function updateRules(): array {
        // Relax the required rule for partial updates
        return ['email' => ['sometimes', 'email']];
    }
}
```

## Route Parameter Merging

You often need to include route parameters (like a `{user_id}`) in your validation rules or use them as part of your unique ignore logic.

```php
protected function prepareForValidation(): void
{
    $this->mergeRouteParameters(['user']);
}
```

Now, `$this->validated()['user']` will contain the ID of the bound user.

## Unique Ignores with `routeModel()`

In update requests, you usually want to ignore the record's own ID during uniqueness checks. Use the `routeModel()` helper:

```php
protected function updateRules(): array
{
    return [
        'email' => [
            'sometimes', 'email',
            Rule::unique('users')->ignore($this->routeModel('user')),
        ],
    ];
}
```

## API Documentation

When [dedoc/scramble](/apm-and-devtools/api-docs.md) is installed, your request schemas are inferred automatically from `baseRules()`, `storeRules()`, and `updateRules()`. No extra annotations or `schema()` methods are needed.

> **Deprecated:** `#[ApiRequest]`, `schema()`, and `BodyParam` are deprecated and will be removed in a future release. Remove them from existing request classes — Scramble infers everything from your validation rules.

## Authorization

`authorize()` returns `true` by default. If it returns `false`, the foundation automatically returns a standardized JSON 403 response. Authorization should ideally be handled at the **Policy** layer, not inside the request.

## Container Binding

Form requests are **not registered in the service container**. Laravel auto-resolves them per request via method injection — no binding needed.