Skip to main content

​
Overview

Geni 3.0 documents responses exactly as Laravel sends them, fixes the security issues found in a review of 2.0.1, and is tested on Laravel 10, 11, 12 and 13. Update the package:
Then go through the steps below. Most applications only need steps 1 and 2.
1

Opt in to MCP tools/call over HTTP (if you use it)

tools/call on POST /docs/api/mcp is now disabled by default. To keep it, enable it explicitly:
.env
If you published config/geni.php, add the key to the mcp block:
config/geni.php
MCP clients must now send Content-Type: application/json (other requests get 415). The stdio server php artisan geni:mcp:serve is unaffected. See MCP for the security implications.
2

Regenerate committed specs

Generated documents changed shape:
  • Resource responses are wrapped in data (or the resource’s $wrap key).
  • Paginated collections use {data, links, meta}.
  • Create endpoints are documented as 201.
  • Every operation has an operationId.
Regenerate every spec checked by geni:check:
If geni.cache.enabled is on, run php artisan geni:clear (with the same --api) first, because geni:export serves a cached document when one exists.
3

Define a viewApiDocs gate for non-local access (optional)

Outside local, docs still return 404 unless you define a viewApiDocs gate. When the gate passes, the docs are served; when it denies, the response is 403:
app/Providers/AppServiceProvider.php
User-based gates need a session: add 'web' to geni.middleware. Without a gate nothing changes. See Documentation Authentication.
4

Check your docs credentials

Blank GENI_DOCS_USERNAME / GENI_DOCS_PASSWORD now mean “no credentials gate”. Setting only one of them locks the docs. If you rely on the credentials gate, make sure both values are set.
5

Use only configured API names

?api= values and --api options must be default or a key of geni.apis. Unknown names now return 404 (HTTP) or fail (Artisan) instead of silently using the default document. Check CI scripts that pass --api.
6

Update custom code that reads the document

  • Operation extensions are now top-level keys (x-unauthenticated, x-api, x-geni-unresolved) instead of being nested under x-geni-unresolved.
  • Resource schemas list required keys and may use anyOf / const.

​
What Else Is New