Model Binding & Validation

1. The 3 Places Data Comes From - Zomato Example

When you order pizza, data comes from 3 places:

2. Code It: Zomato Search API

Goal: GET /api/zomato/restaurants/101?includeMenu=true

[HttpGet("restaurants/{id}")]
public ActionResult GetRestaurant(
    [FromRoute] int id, // From URL path: 101
    [FromQuery] bool includeMenu // From?includeMenu=true
) {
    var r = FindRestaurant(id);
    if(r == null) return NotFound();
    if(includeMenu) r.Menu = GetMenu(id);
    return Ok(r);
}

3. Validation: Stop Bad Data at the Door

Theory: [ApiController] gives you auto 400 validation. Never trust client data.

Add to your Order.cs model:

public class Order {
    [Required(ErrorMessage = "Restaurant ID is required")]
    public int RestaurantId { get; set; }

    [Range(1, 10, ErrorMessage = "Quantity must be 1-10")]
    public int Quantity { get; set; }

    [StringLength(200)]
    public string Notes { get; set; }
}

Now POST this: { "Quantity": 0 }
API returns 400 instantly: {"errors": {"Quantity": ["Quantity must be 1-10"]}}
Your code never ran. Crash prevented.

1. Theory: The Binding Source Priority

Question: What if you don’t add [FromRoute] etc?
Answer: [ApiController] infers it:

1. Complex types like Order → Assumes [FromBody]
2. Primitives like int id → Assumes [FromRoute] if name matches route, else [FromQuery]
3. IFormFile → Assumes [FromForm]

Senior Rule: Be explicit. Always add [FromRoute], [FromQuery], [FromBody]. Code is documentation.

2. The 400 Bad Request Checklist

If you get 400, check in this order:

1. JSON Malformed? Missing } or comma. Use Postman JSON validator.
2. Wrong Type? Sent "age":"abc" for int age.
3. Validation Failed? [Required] field was null. [Range] violated.
4. Missing [FromBody]? Sending JSON to method without [FromBody].
5. Wrong Content-Type? Sent JSON but header was text/plain. Must be application/json.

3. Custom Validation - The Interview Edge

Q: "How do you ensure order delivery date is not in past?"

A: Custom Attribute.

public class FutureDateAttribute : ValidationAttribute {
    public override bool IsValid(object value) {
        DateTime dt = (DateTime)value;
        return dt > DateTime.Now;
    }
}

public class Order {
    [FutureDate(ErrorMessage = "Delivery date must be future")]
    public DateTime DeliveryDate { get; set; }
}

This is what separates 8 LPA from 18 LPA. You know how to extend the framework.

4. ModelState.IsValid - When Do You Need It?

With [ApiController]: You DON’T need it. Framework checks and returns 400 before your code runs.

Without [ApiController]: You MUST check manually:

public IActionResult Create(Order o) {
    if(!ModelState.IsValid) {
        return BadRequest(ModelState); // Return errors
    }
    // save...
}

Best Practice: Always use [ApiController]. Less code, safer.