---
title: "Accept only fields you know · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/requests-and-responses/strict-input
updated: 2026-10-20
licence: "All rights reserved"
---

# Accept only fields you know

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Requests and responses](https://agentwranglers.se/playbook/api-design/requests-and-responses)
- Rule: Validate every request body, query parameter and path parameter against its schema at the edge. Reject unknown fields and wrong types with a clear error.
- How: Parse input once into a typed object, as in [parse at the boundary](https://agentwranglers.se/playbook/architecture/data-shapes/parse-at-the-boundary). Rejecting unknown fields also blocks [mass assignment](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/mass-assignment). Cap the body size too, as in [resource limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/resource-limits).
- Check: Send a body with an extra field `"role": "admin"` and one with a string where a number belongs. Both get 400 or 422 naming the field.

Example:

```js
import { z } from 'zod'

const NewOrder = z.strictObject({
  items: z.array(z.strictObject({ sku: z.string(), quantity: z.number().int().min(1) })).min(1),
})

const result = NewOrder.safeParse(request.body)
if (!result.success) return problem(422, result.error.issues)
```

```python
from pydantic import BaseModel, ConfigDict, Field

class Item(BaseModel):
    model_config = ConfigDict(extra="forbid", strict=True)
    sku: str
    quantity: int = Field(ge=1)

class NewOrder(BaseModel):
    model_config = ConfigDict(extra="forbid", strict=True)
    items: list[Item] = Field(min_length=1)
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/requests-and-responses/strict-input`.

- Previous: [Use enums for fixed values](https://agentwranglers.se/playbook/api-design/requests-and-responses/api-enums)
- Next: [Say which format PATCH accepts](https://agentwranglers.se/playbook/api-design/requests-and-responses/patch-format)
- [Requests and responses](https://agentwranglers.se/playbook/api-design/requests-and-responses)