---
url: https://scruple.dev/rules/api-contracts/require-input-validation.md
description: Require validation of untrusted boundary input.
---

# api-contracts/require-input-validation

Require validation of untrusted boundary input.

## What it checks

Explicit route and raw boundary inputs need runtime validation; type annotations alone do not establish that incoming data is valid.

## Rule metadata

* Package: `@scruple/api-contracts`
* Category: Input validation
* Tags: validation, routes, untrusted-input
* Default threshold: `0.85`
* Minimum confidence: `0.7`

## Examples

### Reported

```ts
app.post("/users", req => createUser(req.body));
```

### Accepted

```ts
app.post("/users", req => createUser(UserSchema.parse(req.body)));
```