Agent WranglersRequests and responses Required
Accept only fields you know
Validate every request body against its schema at the edge. Reject unknown fields and wrong types with a clear error.
How to do it
Parse input once into a typed object, as in parse at the boundary. Rejecting unknown fields also blocks mass assignment.
How to check
Send a body with an extra field "role": "admin" and one with a string where a number belongs. Both get 400 or 422 naming the field.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/requests-and-responses/strict-input.