Loading published curriculum…

11 · REST APIs / LESSON 49 OF 102

Request validation

Reject malformed input before business work.

Before this lesson: Controllers and DTOs

Understand the topic

The Validation dependency supplies a provider. @NotBlank rejects null, empty, and whitespace-only values. @Size limits length but alone permits null. @Valid activates body validation.

Validate input shape at the boundary. Business rules such as ownership belong in the service; database constraints protect stored data even from other writers. Replace the existing declarations with the snippet, rather than adding duplicate methods.

EXAMPLE · JAVA

TaskController.java · replace nested record and preview method

public record CreateTask(
    @jakarta.validation.constraints.NotBlank
    @jakarta.validation.constraints.Size(max = 120)
    String title
) {}
@PostMapping("/preview")
public Preview preview(@jakarta.validation.Valid @RequestBody CreateTask input) {
    return new Preview(titles.normalize(input.title()), false);
}

What to expect

Invalid titles return 400; valid input still returns 200.

YOUR TURN

Put it into practice

  1. 01Test missing, blank, 120-character, and 121-character titles.
  2. 02Explain field constraints versus duplicate-title rules.
  3. 03Check invalid requests do not persist data.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

Validation occurs at several boundaries because each boundary protects a different invariant.

  1. 01Request constraints validate syntax and shape. Service rules validate business meaning, such as ownership or allowed transitions. Database constraints protect persisted relationships and uniqueness.
  2. 02NotBlank includes a non-null requirement; Size alone does not. Nested request objects need cascaded validation when their fields also carry constraints.
  3. 03Do not let client-side validation be the only defense; clients can send arbitrary HTTP requests without your UI.

A mistake worth avoiding

A validation annotation without an active provider or @Valid may not run at all.

DEBUGGING ROOM

Something broke. Where do you look?

A blank title reaches the service despite a constraint on the record.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Which rule is best enforced by a database constraint as well as application logic?

Choose one answer

BUILD IT YOURSELF

Build a boundary test matrix

  1. 1.List null, missing, empty, whitespace, and length boundaries.
  2. 2.Send each request directly to the API.
  3. 3.Assert invalid input produces no new row.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Which rule belongs in the service rather than a field annotation?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

Explain the roles of constraints, @Valid, and the provider.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references