An API should never assume that incoming request data is correct.

Clients can send:

• Missing required properties.
• Incorrect data types.
• Invalid email addresses.
• Unexpected properties.
• Empty strings.
• Extremely large payloads.
• Malformed identifiers.

Without validation, invalid information may enter your database or cause unexpected application errors.

Validation should happen before business logic executes.

We will use Zod to define reusable validation schemas and validate request bodies, query parameters, and route parameters.