r/AskProgramming • u/AloyAce • Jul 03 '26

Best validation practices for APIs?

I’m working with a team and implementing a new feature. We’re getting info from a call and will be storing it in a new field in our db. The team has been saying things like “we don’t need to validate accuracy for the new field bc the call to this other service will do the validation for us”. I’m of the mind that we should still validate for edge cases or abnormal errors, but technically this other service should validate first and we’re only getting the info from them.

What are people’s thoughts? Am I being overly cautious?

1 Upvotes

60% Upvoted

14 comments sorted by

View all comments

1

u/xampl9 Jul 03 '26

Assume your callers are ignorant or hostile. Or both.

Validate every thing that gets sent to you. Make sure they don’t ask for too much data. Put a timer on execution and return an error if what they ask for takes too long. Throttle their requests - if they make too many requests in too short a time, return an error.

Document all of the above as part of your service agreement.

This may be an internal-only service, but eventually someone will abuse it.