DTO · Data Transfer Object

Understand the idea

A request DTO exposes only the inputs clients are allowed to supply. Validation constraints belong on those inputs. Separating it from the stored document prevents accidental binding of database ids, password hashes, or ownership fields.

A concrete example

public record TodoRequest(
    @NotBlank String title,
    @NotNull Boolean completed
) {}

In the application

TodoRequest permits title and completed. The personal API assigns ownerId from the verified JWT rather than accepting it in the DTO.

Filtering ownerId out of a form is insufficient unless the server also refuses to trust client-supplied ownership.

Related concepts

• Bean Validation
• Request-body binding
• Authorization / ownership