Use Zod or Pydantic to check every input

Cost

Open source. Both are MIT licensed and free to use. Pydantic's company sells separate paid products that you do not need.

How to do it

Zod 1.0 came out in March 2020, and version 4.6.7 shipped in October 2026. It has about 207 million weekly downloads. Pydantic 1.0 came out in October 2019, and version 2.14.1 shipped in October 2026, with about 243 million weekly downloads. Both are MIT licensed. One schema gives the check, the type and the error message, as accept only known fields asks. Choose something else when the framework has its own checks, such as Django forms, or when another schema library is already in use.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

TypeScript example

import { z } from 'zod';

const NewOrder = z.strictObject({ productId: z.string().uuid(), quantity: z.number().int().min(1).max(99) });

app.post('/orders', (req, res) => {
  const result = NewOrder.safeParse(req.body);
  if (!result.success) return res.status(400).json({ errors: result.error.issues });
  res.status(201).json(createOrder(result.data));
});

Python example

from uuid import UUID
from pydantic import BaseModel, ConfigDict, Field

class NewOrder(BaseModel):
    model_config = ConfigDict(extra="forbid")
    product_id: UUID
    quantity: int = Field(ge=1, le=99)

How to check

Every route handler reads its input through a schema parse call. A test sends each route one unknown field and one wrong type, and gets 400 or 422.

Sources

• Zod
• Pydantic

Related rules

• Use Express for a Node.js server in Software choices
• Use FastAPI for a Python API in Software choices
• Accept only fields you know in API design