Annotations

@SproutResource

Marks a JPA entity as a Sprout resource and controls what is generated.

@SproutResource(
    name                  = "",
    path                  = "",
    readOnly              = false,
    include               = {},
    exclude               = {},
    authenticationPrincipal = false,
    generateSwaggerDocs   = true,
    overrideRepository    = false,
    tag                   = "",
    summary               = ""
)

Fields

name

Used for generated class names and (by default) to derive the endpoint path. If empty, the entity class name is used.

// Generates SproutCatalogItemController, /api/catalogitems, etc.
@SproutResource(name = "CatalogItem")

---

path

Overrides the base URL path. If empty, Sprout derives it as /api/{name-lowercase}s (simple pluralization by appending s).

@SproutResource(path = "/api/v1/books")
@SproutResource(path = "/catalog")

Use path for irregular plurals (Person → /api/people) or versioned paths.

---

readOnly

If true, Sprout generates only the two read endpoints (GET / and GET /{id}). CREATE, UPDATE, and DELETE are not generated regardless of include. Read endpoints can still be removed via exclude.

---

include / exclude

Fine-grained endpoint selection using the Endpoint enum: GET_ALL, GET_BY_ID, CREATE, UPDATE, DELETE.

exclude wins over include. If include is empty, all endpoints are generated by default.

// Only expose GET-by-id and DELETE:
@SproutResource(include = { Endpoint.GET_BY_ID, Endpoint.DELETE })

// Everything except DELETE:
@SproutResource(exclude = { Endpoint.DELETE })

---

authenticationPrincipal

If true, controller methods get an Authentication authentication parameter and pass it through to the operations layer. Requires Spring Security on the compile classpath.

---

generateSwaggerDocs

If true (default) and SpringDoc annotation types are on the compile classpath, Sprout adds @Tag on the controller class and @ApiResponses on each generated method. If the needed classes are absent, Sprout logs a warning and generates without these annotations.

---

overrideRepository

• false (default): the generated repository is a @Repository Spring Data bean.
• true: the generated repository is marked @NoRepositoryBean. You provide your own interface extending it. See Customization.

---

tag / summary

Used only for Swagger/OpenAPI generation. tag is the OpenAPI tag name; summary is the tag description. If tag is empty, Sprout uses name (if set) or the class name.

---

@SproutPolicy

Attaches per-operation Spring Security @PreAuthorize expressions to the generated controller methods.

@SproutPolicy(
    read   = "",
    create = "",
    update = "",
    delete = ""
)

Non-blank policy strings are added as @PreAuthorize("...") on the corresponding controller methods (read covers both GET_ALL and GET_BY_ID).

Sprout validates SpEL syntax at compile time and emits a compilation error for invalid expressions.

@Entity
@SproutResource
@SproutPolicy(
    read   = "isAuthenticated()",
    create = "hasRole('ADMIN')",
    update = "hasRole('ADMIN')",
    delete = "hasRole('ADMIN')"
)
public class Book { ... }

Caution

@PreAuthorize has no effect unless method security is enabled. Either annotate a @Configuration class with @EnableMethodSecurity, or set sprout.security.method-security.enabled=true via sprout-runtime.

---

@SproutId

Overrides ID detection. Use when your entity’s identifier field is not annotated with @jakarta.persistence.Id or @javax.persistence.Id, or when you want Sprout to route controller operations through a different property than the JPA primary key.

Can be placed on a field or a getter method.

@Entity
@SproutResource
public class User {
    @Id
    private Long dbId;

    @SproutId               // Sprout uses this as the path variable
    private String username;
}

This changes:

• The {id} path variable type in generated endpoints (becomes String).
• The JPQL used by the repository delete query (deletes by username not dbId).
• The ID_CLASS and ID_PROPERTY constants in the marker class.

For ID resolution priority and caveats, see ID Resolution.