Validate and sanitize an incoming request body with a schema

A string showed up where my API expected a number, and the crash happened three layers deep before I could see why.

IntermediateRead 5 minDoing: an hour6 steps

What you'll have at the end

A schema that rejects a malformed request body with a 400 and a clear message before it ever reaches your route logic

Before you start

You need

A route handler that reads fields straight off the request body and passes them to code further down that assumes they already carry the right type.

Not covered

Confirming the values are true, such as whether a referenced item actually exists in your data: that needs a lookup this schema never performs.

Leans on

6 steps

Catching unhandled promise rejections in an async Express route

For a rejection thrown after the body already passed this schema, inside an async handler or a call it makes.

Checked 25 Aug 2026