Request validation

Nothing untrusted goes past the edge

Every part of a request is user input, including path and query parameters. Validate all of them against a schema at the boundary, and let the rest of the code work with a typed, known-good object.

Errors should say which field failed and why. A single "invalid request" message forces the client developer to bisect their payload by hand.

Decide explicitly what happens to unknown fields. Silently ignoring them hides client typos; rejecting them is stricter but can break clients when you later remove a field.