What you need to know
A client can be outdated, modified, or called directly. Validation at the API boundary prevents malformed data from reaching business logic and gives clients a predictable way to correct problems.
How to apply it
Check required fields, types, lengths, allowed values, and cross-field rules before saving. Normalize values deliberately and return a stable error shape that identifies the relevant field.
Common mistake to avoid
Do not rely only on HTML required attributes or frontend validation. Those improve usability but can be bypassed by any direct request.