Start here. This is the direct spoken answer to practice first.
Why this question matters
One class can be convenient, but it couples public input, business behavior, and storage shape. I separate models when those responsibilities have different constraints or reasons to change.
Request DTOs define what callers may send and prevent accidental over-posting. Response DTOs shape the public contract without exposing navigation properties or internal fields. Domain types protect business invariants, while persistence models reflect database mapping when that shape would distort the domain. For simple CRUD with little behavior, using an EF entity internally and projecting to API DTOs may be enough.