API schema validation

What it means

API schema validation means checking each request against a formal description of what the endpoint accepts: which fields exist, what type each one is, how long it may be, and which values are allowed. Anything that does not fit is refused before your code acts on it.

The description is usually an OpenAPI document or a JSON Schema. Think of it as a customs form for data. If a field is not on the form, or is the wrong kind of thing, it does not get through the door.

Why it matters

Without it, each handler decides for itself what to trust, and some will trust too much. A text field arrives where a number was expected. A list shows up with a million entries. An extra field such as role is quietly saved because nothing said it was not allowed.

A schema turns those surprises into a clean error. It is a cheap way to narrow input validation and to stop mass assignment, because unknown fields are refused rather than copied into a record. Teams often add it once and then forget it, so it keeps working quietly in the background.

How it shows up

You meet it in an API gateway, in a framework that reads the OpenAPI file, or in validation code at the top of each handler. The usual gaps are schemas that allow additional properties by default, strings with no maximum length, and documents that drifted from what the code really accepts.

Also check what happens on failure. A good API answers with a plain 400 or 422 and no stack trace. Check that the schema covers every method and version, including old ones nobody remembers. A schema checks shape, not permission, so it never replaces an ownership check.