Need help with your APIs? I offer API discovery, governance & evangelism services. Explore services →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Bean Validation

Bean Validation is a Java/Jakarta EE specification (JSR 303, JSR 349, and JSR 380) that defines a declarative, annotation-based model for validating object data — placing constraints like @NotNull, @Size, and @Email directly on fields so the same rules are enforced consistently across application layers, including API request payloads.

Bean Validation is the Java standard for declaring data constraints as annotations and enforcing them uniformly wherever an object is validated. Introduced as JSR 303, refined in JSR 349, and modernized as JSR 380 (now Jakarta Bean Validation), it lets a developer annotate a field with rules such as @NotNull, @Size(min=1, max=64), or @Email and have those rules checked by a single validation engine rather than by scattered, hand-written checks. Hibernate Validator is the reference implementation.

  • Declarative constraints - Validation rules live as annotations on the data model itself, keeping the rules close to the data they govern.
  • Layer-independent enforcement - The same constraints apply at the presentation, business, and persistence layers, so a value is validated the same way everywhere.
  • Extensible constraint set - Beyond the built-in annotations, teams define custom constraints for domain-specific rules.
  • Framework integration - It plugs directly into Spring, Jakarta REST (JAX-RS), and JPA, so incoming request bodies are validated before they reach business logic.

In API operations, Bean Validation is where a Java service turns its request contract into enforced reality — an incoming payload is bound to an annotated object and rejected with clear errors before any handler runs. That makes it the server-side complement to schema constraints expressed in OpenAPI or JSON Schema: the interface documents the rules, and Bean Validation guarantees them at the boundary, which matters increasingly as automated and agentic clients send payloads that must be validated deterministically.