Comparison questionMedium~7 minAPI Contracts & Design / 1 of 15

Interview question

What is the difference between model binding and validation in an ASP.NET Core API?

Model binding vs validation in ASP.NET Core

Compare request binding and validation responsibilities in ASP.NET Core APIs.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Model binding reads route, query, header, form, or body values and converts them into parameters or a request DTO. Validation runs after or alongside that conversion and checks rules such as required values, ranges, lengths, and allowed combinations. A value can bind successfully and still be invalid: pageSize=5000 is a valid integer but may violate the API's maximum page size.

Full answer below

Practice focus

input conversion, request DTOs, contract validation, business rules, and error consistency

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this matters
Binding answers whether request data can be converted into the endpoint's .NET input shape. Validation answers whether that successfully bound input is allowed for this contract and operation.
Model binding reads route, query, header, form, or body values and converts them into parameters or a request DTO. Validation runs after or alongside that conversion and checks rules such as required values, ranges, lengths, and allowed combinations. A value can bind successfully and still be invalid: pageSize=5000 is a valid integer but may violate the API's maximum page size.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I separate malformed input from validly shaped input that violates the request contract. Invalid JSON or an unparseable route value is a binding failure. A missing name, negative quantity, or invalid date range is validation. Request DTO validation protects the transport contract, application services enforce use-case rules such as account state, and domain objects protect invariants shared by every entry point. That keeps controllers thin without pushing HTTP parsing concerns into the domain.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I keep one stable ProblemDetails format while preserving useful field-level errors for clients. Nullable request properties distinguish absence from default values when partial updates or optional fields require it. I avoid asynchronous database calls inside attribute validation and perform those checks in the application operation where cancellation, authorization, and transaction ownership are clear. Contract tests cover malformed JSON, conversion errors, missing fields, cross-field rules, and business conflicts from HTTP and non-HTTP entry points. Validation reduces invalid requests; database constraints and domain invariants still defend concurrent and alternative write paths.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Assuming binding means valid input
Putting all business rules in DTO attributes
Returning inconsistent validation errors
Relying on frontend validation only
Binding directly to EF entities

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

Cannot separate binding from validation
Treats validation as UI-only
Ignores domain invariants
Does not test invalid payloads

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Where would you validate pageSize?
When is 400 different from 409?
How would validation work outside HTTP?
How do you keep error responses consistent?

Interviewer notesInterviewerInterviewer notesWhat the interviewer is listening for.Open details

Details

Look for layered validation and concrete status-code thinking.

Recruiter notesRecruiterRecruiter notesHow to frame the answer for screening conversations.Open details

Details

This question checks whether the candidate can build robust APIs instead of happy-path endpoints.

Continue the section

Next in API Contracts & Design: ProblemDetails vs Custom Errors

Step 2 of 15

ProblemDetails vs custom error responses

Opening drill

Comparison questionMedium~7 minAPI Contracts & Design / 1 of 15

Interview question

What is the difference between model binding and validation in an ASP.NET Core API?

Model binding vs validation in ASP.NET Core

Compare request binding and validation responsibilities in ASP.NET Core APIs.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

input conversion, request DTOs, contract validation, business rules, and error consistency

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this matters
Binding answers whether request data can be converted into the endpoint's .NET input shape. Validation answers whether that successfully bound input is allowed for this contract and operation.
Model binding reads route, query, header, form, or body values and converts them into parameters or a request DTO. Validation runs after or alongside that conversion and checks rules such as required values, ranges, lengths, and allowed combinations. A value can bind successfully and still be invalid: pageSize=5000 is a valid integer but may violate the API's maximum page size.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I separate malformed input from validly shaped input that violates the request contract. Invalid JSON or an unparseable route value is a binding failure. A missing name, negative quantity, or invalid date range is validation. Request DTO validation protects the transport contract, application services enforce use-case rules such as account state, and domain objects protect invariants shared by every entry point. That keeps controllers thin without pushing HTTP parsing concerns into the domain.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I keep one stable ProblemDetails format while preserving useful field-level errors for clients. Nullable request properties distinguish absence from default values when partial updates or optional fields require it. I avoid asynchronous database calls inside attribute validation and perform those checks in the application operation where cancellation, authorization, and transaction ownership are clear. Contract tests cover malformed JSON, conversion errors, missing fields, cross-field rules, and business conflicts from HTTP and non-HTTP entry points. Validation reduces invalid requests; database constraints and domain invariants still defend concurrent and alternative write paths.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Assuming binding means valid input
Putting all business rules in DTO attributes
Returning inconsistent validation errors
Relying on frontend validation only
Binding directly to EF entities

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

Cannot separate binding from validation
Treats validation as UI-only
Ignores domain invariants
Does not test invalid payloads

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Where would you validate pageSize?
When is 400 different from 409?
How would validation work outside HTTP?
How do you keep error responses consistent?

Interviewer notesInterviewerInterviewer notesWhat the interviewer is listening for.Open details

Details

Look for layered validation and concrete status-code thinking.

Recruiter notesRecruiterRecruiter notesHow to frame the answer for screening conversations.Open details

Details

This question checks whether the candidate can build robust APIs instead of happy-path endpoints.

Continue the section

Next in API Contracts & Design: ProblemDetails vs Custom Errors

Step 2 of 15

ProblemDetails vs custom error responses

What is the difference between model binding and validation in an ASP.NET Core API?

Practice focus

Answer path

Why this matters

Review signals

Follow-up prompts

Continue the section

What is the difference between model binding and validation in an ASP.NET Core API?

Practice focus

Answer path

Why this matters

Review signals

Follow-up prompts

Continue the section