Field Attributes

This reference covers every supported field-level attribute. Model-level (@@) attributes live in their dedicated guides — see audit log for @@audit, soft delete for @@soft_delete, pagination for @@paged, and auth support matrix for @@allow / @@deny.

Identity & Defaults

Attribute	Behaviour
`@id`	Marks the primary-key field. Required; exactly one per model.
`@default(value)`	Server-side default applied when the create input omits the field.
`@default(cuid())`	Macro-emitted CUID on create.
`@default(auth().x)`	Pulls a value from the auth context. Supports nested paths (`auth().organization.id`).
`@default(dbgenerated())`	Defers to the database default — the column must declare `DEFAULT` in SQL.

Auth-defaulted columns are limited to String/Cuid, Int, and Boolean and act as fallbacks: they fill the field only when the create input omits it. They are not enforcement.

Exposure controls

Attribute	Effect on input	Effect on output	Effect on audit
`@readonly`	Excluded from Create + Update inputs	Visible in responses	Visible in `before`/`after`
`@server_only`	Excluded from Create + Update inputs	Stripped from responses	Omitted entirely from snapshots
`@pii`	No effect	No effect	Redacted as `"<redacted: pii>"`
`@sensitive`	No effect	No effect	Redacted as `"<redacted: sensitive>"`

Use @readonly for columns the server writes but clients may read (audit timestamps, computed totals). Use @server_only for columns clients should never see (internal risk scores, raw token blobs). Use @pii or @sensitive to control audit redaction without changing input/output surfaces.

Optimistic locking

Attribute	Behaviour
`@version`	Marks the optimistic-lock column. Required `Int`; one per model; not on the primary key.

See optimistic locking for the full contract. The macro excludes @version from both Create and Update inputs. The runtime seeds it to 0 on create and bumps it in the same statement as every update or soft-delete.

Validators

Attribute	Applies to	Behaviour
`@length(min, max)`	`String`, `Cuid`	Inclusive length check.
`@range(min, max)`	`Int`, `Decimal`	Inclusive numeric range. Integer bounds promote to Decimal.
`@email`	`String`	Pragmatic email shape check.
`@regex(pattern)`	`String`	Pattern compiled at macro time.
`@uri`	`String`	Must parse as a URI.
`@iso4217`	`String`	Three ASCII uppercase letters.

See validators for the full surface, including the PII-safe error message contract.

Type modifiers

Suffix	Meaning	Example
`?`	Nullable / optional	`notes String?`
`[]`	List	`tags String[]`

Lists are supported only for a subset of scalars in the current slice; banks running JSON columns prefer @db.JsonB on a String for richer payloads.

Composition

Multiple attributes on one field are space-separated and additive:

model Transfer {
  id Int @id
  amount Decimal @range(min: 0)
  notes String? @sensitive @length(max: 4000)
  reservationId String @server_only
  version Int @version
}

The macro applies them in this evaluation order:

exclusion from inputs (@id, @readonly, @server_only, @version, @default(...))
validation on whatever survives (@length, @range, @regex, @email, @uri, @iso4217)
policy evaluation (model-level @@allow / @@deny)
SQL execution
response projection (server_only stripped here)
audit snapshot (pii / sensitive redacted here)

Overview

Get Started

Guides

Banking Readiness

Architecture

Tooling

Studio

Reference

Internals

Field Attributes

Field Attributes

Identity & Defaults

Exposure controls

Optimistic locking

Validators

Type modifiers

Composition

​Field Attributes

​Identity & Defaults

​Exposure controls

​Optimistic locking

​Validators

​Type modifiers

​Composition

Field Attributes

Identity & Defaults

Exposure controls

Optimistic locking

Validators

Type modifiers

Composition