Build a validated FastAPI create endpoint with safe models

• Use separate request and response models.
• Forbid unexpected request fields.
• Validate non-empty lines, positive quantity, and bounded SKU text.
• Derive owner and server-managed state from trusted context.
• Declare the response model and 201 status explicitly.

1. Define strict nested Pydantic request models.
2. Define a smaller public response model.
3. Inject the authenticated principal and application service.
4. Map only allowed values into a command and add trusted ownership.
5. Return the service result through the declared response model.

from typing import Annotated
from uuid import UUID
from fastapi import APIRouter, Depends, status
from pydantic import BaseModel, ConfigDict, Field

class OrderLineIn(BaseModel):
    model_config = ConfigDict(extra="forbid")
    sku: str = Field(min_length=1, max_length=64)
    quantity: int = Field(gt=0, le=100)

class CreateOrderIn(BaseModel):
    model_config = ConfigDict(extra="forbid")
    customer_ref: str = Field(min_length=1, max_length=80)
    lines: list[OrderLineIn] = Field(min_length=1, max_length=50)

class OrderOut(BaseModel):
    id: UUID
    status: str
    line_count: int

router = APIRouter()

@router.post("/orders", response_model=OrderOut, status_code=status.HTTP_201_CREATED)
async def create_order(
    body: CreateOrderIn,
    actor: Annotated[Principal, Depends(current_principal)],
    service: Annotated[OrderService, Depends(order_service)],
) -> OrderOut:
    command = CreateOrder(
        owner_id=actor.user_id,
        customer_ref=body.customer_ref,
        lines=[CreateLine(sku=x.sku, quantity=x.quantity) for x in body.lines],
    )
    created = await service.create(command)
    return OrderOut(id=created.id, status=created.status, line_count=len(created.lines))

Validation and mapping are O(number of lines). Persistence cost is owned by the application service and should remain one bounded transaction.

• Duplicate SKUs need an explicit merge-or-reject rule.
• Whitespace normalization should be deliberate, not accidental.
• A valid shape can still fail authorization or a business invariant.
• Response filtering is a final boundary, not permission to return secrets internally.

• Submit owner, status, and unknown fields and expect validation failure.
• Submit zero lines and invalid quantities.
• Verify ownership comes from the principal, not the body.
• Verify the response cannot expose an internal field added to the service result.

• Using one ORM/Pydantic model for input and output creates mass-assignment and disclosure risk.
• Accepting an owner ID from the client breaks the trust boundary.
• Returning the persistence object makes future fields public accidentally.
• Validation alone does not enforce authorization or business rules.