Recap — Validation, Serialization, Error Responses

# Validation, Serialization, Error Responses Pydantic is what makes FastAPI's validation work. Get this layer right and your API rejects bad input automatically with clear error messages. ## Basic models ```python from pydantic import BaseModel from datetime import datetime class UserCreate(BaseModel): name: str email: str age: int class UserResponse(BaseModel): id: int name: str email: str created_at: datetime ``` `UserCreate`: shape of incoming request. `UserResponse`: shape of outgoing response. ## Field constraints ```python from pydantic import BaseModel, Field, EmailStr from typing import Annotated class UserCreate(BaseModel): name: Annotated[str, Field(min_length=2, max_length=50)] email: EmailStr # validated email age: Annotated[int, Field(ge=0, le=150)] # 0 <= age <= 150 tags: Annotated[list[str], Field(default_factory=list)] nickname: str | None = None # optional ``` `Field`: constraints (min/max, regex, etc.). `EmailStr`: built-in email validator. For a Field with constraints, use `Annotated[type, Field(...)]` syntax (Pydantic v2 preferred). ## Custom validators ```python from pydantic import BaseModel, field_validator class UserCreate(BaseModel): password: str @field_validator("password") @classmethod def password_strength(cls, v: str) -> str: if len(v) < 8: raise ValueError("password must be at least 8 characters") if not any(c.isdigit() for c in v): raise ValueError("password must contain at least one digit") return v ``` For cross-field validation: ```python from pydantic import model_validator class PasswordReset(BaseModel): password: str password_confirmation: str @model_validator(mode="after") def passwords_match(self): if self.password != self.password_confirmation: raise ValueError("passwords don't match") return self ``` ## Error responses When validation fails, FastAPI returns 422 with structured details: ```json { "detail": [ { "type": "string_too_short", "loc": ["body", "name"], "msg": "String should have at least 2 characters", "input": "A", "ctx": {"min_length": 2} } ] } ``` Clients can map this to UI errors. ## Custom HTTPException For business-logic errors (not validation): ```python from fastapi import HTTPException, status @app.get("/users/{user_id}") def get_user(user_id: int): user = db.get(user_id) if not user: raise HTTPException( status_code=status.HTTP_404_NOT_FOUND, detail="User not found" ) return user ``` For typed error responses: ```python class ErrorResponse(BaseModel): error: str code: str details: dict | None = None @app.exception_handler(ValueError) def value_error_handler(request, exc): return JSONResponse( status_code=400, content=ErrorResponse( error=str(exc), code="invalid_input", ).model_dump(), ) ``` ## Pydantic vs SQLAlchemy models ORM models represent DB rows; Pydantic models represent API contracts. They SHOULD be different: ```python # SQLAlchemy class User(Base): __tablename__ = "users" id: Mapped[int] = mapped_column(primary_key=True) email: Mapped[str] password_hash: Mapped[str] # NEVER expose this is_admin: Mapped[bool] # Pydantic class UserResponse(BaseModel): id: int email: str # No password_hash, no is_admin model_config = ConfigDict(from_attributes=True) # allows ORM → Pydantic conversion ``` `from_attributes=True` (was `orm_mode=True` in v1) lets Pydantic construct from an ORM object. ```python user = db.query(User).first() response = UserResponse.model_validate(user) # converts ORM → Pydantic ``` ## Common patterns ### Different schemas per operation ```python class UserBase(BaseModel): email: EmailStr name: str class UserCreate(UserBase): password: str # only on create class UserUpdate(BaseModel): name: str | None = None # all fields optional on update email: EmailStr | None = None class UserResponse(UserBase): id: int created_at: datetime # No password ``` Inherit common fields; specialize per use case. ### Partial updates (PATCH) ```python @app.patch("/users/{user_id}", response_model=UserResponse) def update_user(user_id: int, payload: UserUpdate): user = get_user(user_id) for field, value in payload.model_dump(exclude_unset=True).items(): setattr(user, field, value) db.commit() return user ``` `exclude_unset=True` = only fields the client provided. ### Nested models ```python class Address(BaseModel): street: str city: str zip: str class UserCreate(BaseModel): name: str address: Address ``` JSON body: ```json { "name": "Alice", "address": {"street"