That depends on the language and deserialisation library used. And that is also the reason why I have multiple classes. My CreateTaskRequest class which is use

That depends on the language and deserialisation library used. And that is also the reason why I have multiple classes. My CreateTaskRequest class which is used for deserialisation only does not have defaults (unless intentional) so it throws when required values are not present in the source json. It also takes care of dateformat/uuid parsing. The output is always fully valid typed or it throws. It’s a 1-to-1 mapping on what is described in the API docs. The service layer that takes CreateTaskRequest and converts to Task for persistence is where the business logic validation happens (valid foreign keys, date ranges, etc, unique checks). Cleanly separated from deserialization. For reference: I use Kotlin with Jackson which has great support for this.