Spring Boot· 45 min

Spring Boot REST APIs and Validation

Build controllers, DTOs, validation, global error handling, pagination, sorting, and API documentation.

Java interview lesson
Question 20 · Not reviewed

Spring Boot · web

Can you explain this clearly in an interview?

Use the strong answer as your reference, explain it aloud in your own words, then choose how soon you want to review it again.

Interview prompt

Spring Boot REST APIs and Validation

Explain it aloud in your own words

Strong answer

A production REST endpoint validates input at the boundary, calls an application service, maps domain outcomes to stable responses, and handles errors consistently. DTOs, pagination, idempotency, and documentation make the contract usable by other teams.

Key points

  • Validation errors should identify fields without leaking internal details.
  • Do not expose entities directly as long-term API contracts.
  • Use request IDs and structured logs to connect failures across services.
  • Document authentication, pagination, status codes, and error shapes.

Interviewer looks for

Walk through one endpoint, including invalid input, missing data, authorization failure, database failure, and a successful response.

Java example

1@PostMapping
2ResponseEntity<OrderResponse> create(@Valid @RequestBody CreateOrderRequest request) {
3  return ResponseEntity.status(HttpStatus.CREATED)
4    .body(mapper.toResponse(service.create(request)));
5}

Topic interview questions

Revise this topic like an interviewer

These questions are tied to this lesson. Read each question aloud, then compare your explanation with the strong answer.

5 questions
Q1Intermediate

What does @Valid do on a Spring MVC request?

Strong answer

It asks the validation provider to check constraints on the bound request object before the controller method proceeds. The API should translate failures into a stable field-level error response.

Q2Intermediate

How should global REST error handling be implemented?

Strong answer

Use a consistent error representation and a centralized exception handler to map validation, domain, authorization, and unexpected failures to appropriate status codes. Do not leak stack traces or database details.

Q3Intermediate

Why should API entities and DTOs be separate?

Strong answer

Separate DTOs prevent persistence changes from silently changing the public contract, limit fields returned to clients, and make request validation explicit. Mapping is an intentional boundary rather than accidental serialization.

Q4Intermediate

How do you make a create endpoint safe to retry?

Strong answer

Accept an idempotency key or use a client-provided unique identifier, persist the result of the first successful attempt, and return the same outcome for retries. This prevents duplicate orders or payments.

Q5Intermediate

What should API documentation include?

Strong answer

Document request and response schemas, validation rules, authentication, status codes, error shapes, pagination, sorting, rate limits, and idempotency behavior. Examples should cover both success and failure paths.

How well do you know this?

Your review choice is saved locally and synced to your learner profile when signed in.