Jakarta Bean Validation in Spring Boot

Validation is one mechanism with four entry points, and the failure mode of picking the wrong one is silence: a constraint that is never evaluated, or one evaluated with the wrong group, produces an unguarded write. State the entry point for every constraint, then normalize every violation into one error contract.

When to use

• A request body, form, or query parameter is untrusted, or create and update flows need different rules for the same type.
• A built-in constraint cannot express the rule: a format, a range policy, a cross-field invariant, or a nested, collection, or map element.
• Configuration must fail fast when a value is missing or out of range, and violations must reach the client as a stable, machine-readable error body.

When not to use

• The error body shape, status policy, and RFC 9457 contract belong to spring-boot-rest-api, and field naming and record shape to spring-boot-dto.
• Property binding and precedence belong to spring-boot-core, entity mapping and database constraints to spring-boot-data-jpa.
• Trust decisions belong to spring-boot-security.

Ownership and sibling boundaries

This skill owns constraint declarations, group design, custom validators, and the normalization of violations.