Introduction

Validation is one of the first lines of defense in any API. Every request entering an application should be validated before reaching the business logic or database. Proper validation prevents invalid data, protects against security vulnerabilities, improves API reliability, and provides meaningful feedback to API consumers.

Modern Spring Boot applications use Jakarta Bean Validation (JSR 380 / Jakarta Validation) together with Hibernate Validator to validate request payloads. Validation can occur at multiple levels, including request parameters, path variables, headers, request bodies, business rules, and database constraints.

Enterprise APIs combine syntactic validation, semantic validation, and business validation to ensure data quality while maintaining a consistent and secure API contract.

---

What You'll Learn

• Input Validation
• Bean Validation
• Jakarta Validation
• Custom Validators
• Business Validation
• Request Sanitization
• Spring Boot Validation
• Validation Groups
• Error Responses
• Enterprise Best Practices

---

Enterprise Validation Architecture

              Client Request
                    │
                    ▼
              API Gateway
                    │
                    ▼
          Spring Boot Controller
                    │
             Bean Validation
                    │
         Business Rule Validation
                    │
          Service Layer Validation
                    │
           Database Constraints
                    │
                    ▼
          Success / Validation Error

---

Request Validation Flow

Client Request

↓

JSON Parsing

↓

Bean Validation

↓

Custom Validation

↓

Business Validation

↓

Service Layer

↓

Database

---

1. What is API Validation?

Answer

API Validation is the process of verifying that incoming requests satisfy predefined rules before business processing begins.

Validation ensures:

• Required fields are present
• Data types are correct
• Values are within acceptable ranges
• Business rules are satisfied
• Invalid requests are rejected early

---

2. Why is Validation Important?

Answer

Validation provides several benefits:

• Prevents invalid data
• Improves security
• Reduces database errors
• Improves user experience
• Protects business logic
• Simplifies debugging

Failing fast at the API boundary is more efficient than allowing invalid data to propagate through the system.

---

3. What Types of Validation Exist?

Answer

Enterprise APIs commonly perform multiple validation types.

Validation Type	Purpose
Required Field Validation	Mandatory fields
Data Type Validation	String, Number, Boolean
Format Validation	Email, Phone, UUID
Range Validation	Min / Max values
Length Validation	String length
Business Validation	Domain rules
Cross-Field Validation	Multiple field relationships
Database Validation	Uniqueness, foreign keys

---

4. What is Jakarta Bean Validation?

Answer

Jakarta Bean Validation is the standard Java validation framework used in Spring Boot.

Common annotations include:

@NotNull
@NotBlank
@NotEmpty
@Email
@Size
@Min
@Max
@Positive
@Pattern
@Past
@Future

These annotations declaratively enforce validation rules on Java objects.

---

5. How is Validation Implemented in Spring Boot?

Answer

Spring Boot integrates Jakarta Validation using the @Valid annotation.

Example

@PostMapping("/users")
public User createUser(
        @Valid @RequestBody UserRequest request) {

    return service.create(request);
}

Spring automatically validates the request before invoking the controller method.

---

6. What is the Difference Between @NotNull, @NotEmpty, and @NotBlank?

Answer

Annotation	Null	Empty	Whitespace
@NotNull	❌	✔	✔
@NotEmpty	❌	❌	✔
@NotBlank	❌	❌	❌

Example

@NotBlank
private String name;

@NotBlank is typically preferred for user-entered text because it also rejects whitespace-only values.

---

7. What are Custom Validators?

Answer

Custom validators enforce rules that built-in annotations cannot express.

Example:

• Age must be at least 18
• Password cannot match username
• Customer ID must follow company format
• Employee email must belong to a corporate domain

Custom validators implement reusable business-specific validation logic.

---

8. What is Business Validation?

Answer

Business validation checks domain-specific rules beyond simple field validation.

Examples:

• Account balance must be sufficient
• Order total must be positive
• Employee must belong to an active department
• Loan amount cannot exceed customer eligibility

Business validation typically belongs in the service layer.

---

9. What is Input Sanitization?

Answer

Input sanitization removes or neutralizes potentially harmful input before processing.

Examples include:

• Escaping HTML
• Removing malicious scripts
• Preventing SQL Injection
• Preventing Cross-Site Scripting (XSS)

Validation verifies correctness, while sanitization reduces security risks.

---

10. What are Validation Groups?

Answer

Validation Groups allow different validation rules for different operations.

Example

Create User

↓

Required Fields

Update User

↓

Optional Fields

They help avoid duplicate DTOs while supporting operation-specific validation.

---

11. How Should Validation Errors be Returned?

Answer

Return clear, field-level validation messages.

Example

{
  "status": 400,
  "message": "Validation Failed",
  "errors": [
    {
      "field": "email",
      "message": "Must be a valid email address"
    },
    {
      "field": "age",
      "message": "Must be greater than or equal to 18"
    }
  ]
}

Clients should be able to identify and correct all invalid fields in a single response.

---

12. What are Spring Boot Validation Best Practices?

Answer

Recommended practices:

• Validate all external input
• Use DTOs instead of entities
• Use @Valid and @Validated
• Return consistent error responses
• Separate business validation from bean validation
• Reuse custom validators
• Document validation rules in OpenAPI

---

13. What are Common Validation Mistakes?

Answer

Common mistakes include:

• Trusting client input
• Skipping server-side validation
• Validating only in the UI
• Using entities directly as request models
• Returning generic validation messages
• Mixing validation with business logic
• Ignoring input sanitization
• Missing boundary checks
• Duplicate validation logic
• Poor documentation

---

14. What are Enterprise Validation Best Practices?

Answer

Enterprise APIs should:

• Validate at the API boundary
• Apply layered validation
• Use standardized error responses
• Validate request headers and parameters
• Protect against malicious input
• Document constraints
• Monitor validation failures
• Keep validation logic reusable and testable

---

15. What Does an Enterprise Validation Architecture Look Like?

Answer

            Client Application
                    │
                    ▼
              API Gateway
                    │
                    ▼
         Spring Boot Controller
                    │
        Jakarta Bean Validation
                    │
       Custom Validators
                    │
      Business Rule Validation
                    │
          Service Layer
                    │
         Database Constraints
                    │
                    ▼
      Success / Validation Error

Enterprise Components

• Spring Boot
• Jakarta Validation
• Hibernate Validator
• Custom Validators
• Global Exception Handler
• OpenAPI Documentation
• Logging & Monitoring
• Database Constraints

---

API Validation Summary

Best Practice	Purpose
Bean Validation	Declarative validation
@Valid	Automatic request validation
Custom Validators	Business-specific rules
DTO Validation	Protect domain model
Input Sanitization	Improve security
Validation Groups	Operation-specific rules
Consistent Error Responses	Better developer experience
Business Validation	Domain integrity
OpenAPI Documentation	Clear API contracts
Layered Validation	Enterprise scalability

---

Interview Tips

1. Explain the difference between syntactic validation, semantic validation, and business validation.
2. Describe how Spring Boot integrates Jakarta Bean Validation using @Valid.
3. Differentiate @NotNull, @NotEmpty, and @NotBlank with practical examples.
4. Explain when custom validators are required instead of standard annotations.
5. Discuss why business validation belongs in the service layer rather than the controller.
6. Highlight the importance of validating all external input, including headers, query parameters, and request bodies.
7. Explain the difference between validation and input sanitization.
8. Mention validation groups for create and update operations.
9. Recommend returning detailed, field-level validation errors instead of generic messages.
10. Use examples from banking, healthcare, and e-commerce systems where strong validation protects business integrity.

---

Key Takeaways

• API validation ensures only valid requests enter the application.
• Jakarta Bean Validation and Hibernate Validator provide a standard validation framework for Spring Boot.
• @Valid enables automatic request validation in REST controllers.
• Standard annotations such as @NotBlank, @Email, and @Size simplify common validation rules.
• Custom validators handle complex business-specific requirements.
• Business validation complements bean validation by enforcing domain rules.
• Input sanitization helps defend against attacks such as SQL Injection and Cross-Site Scripting (XSS).
• Validation errors should clearly identify invalid fields and provide actionable messages.
• Layered validation improves security, maintainability, and data quality.
• API Validation is a core interview topic for Java, Spring Boot, REST APIs, Microservices, Cloud, and Solution Architect roles.