Use request validation to keep invalid data out of business logic and databases.
The core idea
Validation at the API boundary gives callers actionable feedback and keeps downstream code simpler. Bean Validation annotations can express constraints such as required fields, size limits, and numeric ranges.
A practical way to approach it
Define a request DTO, add constraints, enable validation on the controller argument, and handle validation errors with a consistent response format. Keep domain invariants in the domain layer as well, because not every call enters through the HTTP API.
Try it in a small project
For a registration endpoint, validate email shape, password length, and required fields, then test missing and malformed inputs. Never return submitted passwords in logs or error responses.
Common mistakes to avoid
A syntactically valid request can still violate business rules. Validate authorization and domain conditions separately from field-level constraints.
Key takeaway
Keep the first version small, make your assumptions explicit, and verify the result with a repeatable test. For production use, check the current official documentation for the tools and versions you choose.