Chapter 5.2☕ 14 min read

Bean Validation Annotations

Airport security for your API inputs. No bad data gets through.

01The Concept: Validating Input

The RGIA Airport Security Analogy:

At Hyderabad’s Rajiv Gandhi International Airport, you can’t just walk straight onto the airplane. You must pass through security. The security guard checks if your ID is valid (@NotNull), if your bag is the right size (@Size), and if you have prohibited items.

In Spring Boot, the @Valid annotation acts as the security guard. Before the request enters your Java method, Spring checks it against the rules you placed on your DTO fields.

02Technical Explanation

@Valid: Placed in the Controller method parameter. It triggers Spring to validate the object.
@NotBlank: The string cannot be null and must contain at least one non-whitespace character.
@Size(min, max): Checks the length of a string or collection.
@Email: Ensures the string is a valid email format.
@Min / @Max: Checks numeric values.

03Full Working Code: Protecting the API

package com.devinhyderabad;

import jakarta.validation.constraints.Email;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Size;

public class UserRequest {

    @NotBlank(message = "Name is mandatory")
    @Size(min = 3, max = 50, message = "Name must be between 3 and 50 characters")
    private String name;

    @NotBlank(message = "Email cannot be blank")
    @Email(message = "Email should be valid")
    private String email;

    @NotBlank(message = "Password is mandatory")
    @Size(min = 8, message = "Password must be at least 8 characters")
    private String password;

    // Getters and Setters (or use Lombok @Data)
    public String getName() { return name; }
    public void setName(String name) { this.name = name; }
    public String getEmail() { return email; }
    public void setEmail(String email) { this.email = email; }
    public String getPassword() { return password; }
    public void setPassword(String password) { this.password = password; }
}

04The Controller and Validation Flow

package com.devinhyderabad;

import jakarta.validation.Valid;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/users")
public class UserController {

    // @Valid tells Spring to check the rules inside UserRequest
    @PostMapping
    public ResponseEntity<String> createUser(@Valid @RequestBody UserRequest userRequest) {
        // If we reach here, the data is 100% valid!
        return ResponseEntity.status(HttpStatus.CREATED).body("User created successfully!");
    }
}

If you send a POST request with an empty name, Spring Boot will immediately reject it with a 400 Bad Request and never execute the createUser method.

05Why It Matters / Interview Note

Interview Question: “What exception does Spring throw when @Valid fails, and how do you catch it?”

Answer: When @Valid fails, Spring throws a MethodArgumentNotValidException. By default, Spring returns a generic JSON error. To customize this, you catch it inside a @ControllerAdvice class (covered in the next chapter) and return a clean, formatted error response to the client.

Enterprise Note: Never rely on frontend (Angular/React) validation alone. Frontend validation can be bypassed easily using tools like Postman or curl. @Valid on the backend is your ultimate source of truth for data integrity.

Key Takeaways

✅ @Valid triggers Jakarta Bean Validation on controller method parameters
✅ @NotBlank, @Size, @Email, @Min/@Max protect your API from bad data
✅ Validation fails with 400 Bad Request — controller method never executes
✅ Never rely on frontend validation alone; backend @Valid is the source of truth

PreviousLombok Integration 📋 All Chapters Next ChapterGlobal Exception Handling →