Supported integrations

Integrations are how Docuccino understands the packages and conventions you already use. Each one reads a specific part of your app — form requests, API resources, Eloquent models, query builders, authentication — and contributes the matching pieces of your documentation.

This section is organized by what you’re documenting. Start with the page for the concern in front of you; come back to the matrix below when you want to know whether a particular package is supported.

Start with what you’re documenting

RequestsPath parameters, query parameters, request bodies, and file uploads — from your routes and validation rules.

ResponsesSuccess responses from your return types — resources, models, enums, JsonResponse payloads, and 204s.

Resources, models & enumsThe reusable component schemas your responses reference.

Error responses4xx and 5xx from your real exception handling, framework defaults, or the RFC 9457 preset.

AuthenticationSecurity schemes and per-operation requirements from your route middleware.

Rate limitingA 429 response and rate-limit headers from throttle middleware.

How support activates

Mostly, you never switch anything on:

• Laravel’s own conventions are always available — validation, form requests, response inference, API resources, Eloquent models, enums, error handling, rate limiting. There’s no package to detect.
• A package-backed integration activates the moment its package is installed. The Spatie Data support the moment spatie/laravel-data is there, the Passport support the moment Passport is.
• Everything installed is enabled by default, with one exception. Spatie Laravel Permission is opt-in, because documenting role and permission names publishes your app’s internal authorization taxonomy.
• A disabled integration says so. An integration that’s installed but switched off emits one integration.disabled info diagnostic per build, so the switch is always discoverable from the output rather than something you have to remember.

Built with the tools you have

Every integration on this page is built using the same public extension API that’s available to you — you have access to everything Docuccino used to build itself. Nothing here is privileged: if an integration can read a package, so can one you write. See Writing an integration.

The integration matrix

Each row links to the page that covers it. Requires is what has to be installed for the integration to activate; Config is the bag that tunes it. Anything with an integrations.* bag can also be switched off per document with integrations.<key>.enabled = false — see integrations.

Requests & validation

Integration	What it documents	Requires	Config
Validation rules	Laravel’s validation DSL turned into schema constraints — types, formats, sizes, presence, and enumerations	Built in — always on	—
Form requests & inline validate()	Request bodies and query parameters from a form request’s rules(), or an inline $request->validate([...]) / Validator::make(...)	Built in — always on	—
Spatie Data	Data classes as reusable schemas, and request bodies from Data-typed action parameters	spatie/laravel-data	integrations.spatie_data
Laravel Actions	Action classes as controllers — the resolved handle()/asController() signature, a request body from rules(), a 403 from authorize(), and a response body from jsonResponse()	lorisleiva/laravel-actions	integrations.laravel_actions

Responses, models & schemas

Integration	What it documents	Requires	Config
Response inference	Success responses from your action return types — resources, models, enums, JsonResponse payloads with status codes, and 204	Built in — always on	—
API resources	Response schemas from JsonResource shapes, wrapped per the resource’s own $wrap	Built in	integrations.api_resources.wrap
First-party JSON:API resources	JSON:API documents from Laravel’s own JsonApiResource, plus its include / fields[TYPE] parameters	Laravel 13+ — activates when the JsonApiResource class exists	integrations.api_resources
JSON:API resources (timacdonald)	Pre-13 JSON:API documents from timacdonald/json-api resources — identical output to the first-party support, plus include / fields[TYPE]	timacdonald/json-api	integrations.timacdonald_json_api
Eloquent models	Model schemas from columns, refined by $visible / $hidden / $appends / casts — including polymorphic MorphTo as a discriminated oneOf	Built in	integrations.eloquent
Enums	Backed enums by their backing values, #[CaseDescription] prose as x-enumDescriptions, and optional codegen name hints	Built in — always on	representation.enums

Error responses

Integration	What it documents	Requires	Config
Inferred exception handlers	4xx/5xx responses from your real error handling — render callbacks, exception render(), and Responsable exceptions	Built in — always on	error_responses
Problem Details preset	RFC 9457 application/problem+json error responses	Built in — opt-in	error_responses: 'problem-details'
Framework error defaults	Laravel’s stock JSON error shapes — {message, errors} for 422, {message} for 401/403/404	Built in — always on	error_responses

Authentication & operations

Integration	What it documents	Requires	Config
Sanctum	Bearer-token and stateful-cookie security schemes — both modes when a single route carries both	laravel/sanctum	integrations.sanctum
Passport	An OAuth2 security scheme with per-operation scopes read from scope: / scopes: middleware	laravel/passport	integrations.passport.url
Spatie Laravel Permission	role: / permission: / role_or_permission: middleware as an x-permissions member and a description line	spatie/laravel-permission	Opt-in — integrations.permission.enabled
Rate limiting	A 429 response with Retry-After and X-RateLimit-* headers, read from throttle middleware	Built in	integrations.rate_limit
Spatie Query Builder	Filters, sorts, includes, sparse field sets, and pagination — traced through the builder several method calls deep	spatie/laravel-query-builder	integrations.query_builder
Spatie JSON API Paginate	JSON:API page[number] / page[size] (or page[cursor]) pagination parameters from jsonPaginate()	spatie/laravel-json-api-paginate	integrations.json_api_paginate

Quality

Integration	What it documents	Requires	Config
Data-leakage lint	Warns when a schema property name looks sensitive (password, token, secret, api_key, …) before it ships — a diagnostic, never a mutation	Built in — always on	lint.leakage

How contributions combine

Several sources can describe the same operation — an inferred type, an integration, a docblock, an attribute. Docuccino merges them with a clear order of precedence, and higher layers win field by field (an attribute can override one field of a response without discarding the rest):

fallback  <  inference  <  integration  <  docblock  <  attribute  <  overlay  <  config

So an integration’s best guess is always something you can refine with a docblock or an attribute — you’re never fighting the tool.

Every contribution is recorded with its source in the document’s provenance (visible in the raw UIR), labeled by the integration that made it — for example integration:query-builder or integration:sanctum. That’s what lets tooling explain why a given detail is documented the way it is.

Write your own integrationEvery integration above is built with tools you have. Build one for your own package end to end.

Configuration referenceEvery config key, its default, and an example.