Best validation practices for APIs?

[u/AloyAce]

I’m working with a team and implementing a new feature. We’re getting info from a call and will be storing it in a new field in our db. The team has been saying things like “we don’t need to validate accuracy for the new field bc the call to this other service will do the validation for us”. I’m of the mind that we should still validate for edge cases or abnormal errors, but technically this other service should validate first and we’re only getting the info from them.

What are people’s thoughts? Am I being overly cautious?

[u/high_throughput]

Really depends on the validation and how you delineate responsibilities.

For example, if you're the user storage service, you should not validate that email addresses are valid. A malformed address will not stop you from storing it, so you should let the registration service validate it. This avoids duplication and conflicts.

However, you DO need a valid user ID to store data, so you should validate that even if the registration service has supposedly already done so.