Validation
You might say
People can submit complete nonsense. How do I stop bad input before it gets saved?
Check that incoming data has the expected shape and allowed valuesA required field can be checked when someone leaves it, while cross-field rules usually need a submit-time check. Frontend feedback helps people correct mistakes, but the backend must validate again and return specific field errors.
Anatomy
Original input→Validation rules→PassorField error
Forms, URLs, headers, and third parties are all untrusted input.
Define types, required fields, ranges, lengths, and allowed values.
Passing proves schema conformance; authorization, business rules, and output context still need checks.
Typical use cases
Registration
Registration VerificationDescribe how to modify next to the field
Create account
Incomplete email format · Password must be at least 8 characters
Order creation
Product priceReject unreasonable values
Verification resultThe price must be greater than 0
Profile update
Article titleShow length limit when typing
Currently56 wordsMaximum40 words
Webhook input
Request body SchemaValidate API fields in one place
email✓ stringage✕ Should be 1–120role✓ user
Failure will return 400 or 422 and field-level errors according to API convention
Further reading