API Routes & Validation

Overview

Every endpoint is an attack surface. The rule: never trust input. Validate the body, query, and params with zod at the boundary, parse into typed data, then run auth → authorization → data access. Return a consistent error shape with correct HTTP status codes so clients can handle failures predictably. This applies equally to App Router route handlers and Server Actions.

When to use

• Building a route handler (app/api/.../route.ts) or a Server Action.
• Accepting any user/client input.
• You need predictable, typed error responses.

Validated route handler