Validate Data Sent to Web API Endpoints

Sep 19, 2025
5 minutes to read

This topic shows how you can validate user input if you use DevExpress Web API Service for data access.

The following technologies enable data validation:

XPO | EF CoreThese ORM tools allow you to define your Business Model together with validation attributes.XAF Validation ModuleAllows you to apply 10+ predefined rules or any number of custom validation rules to your data objects. Enforces those rules in XAF applications.

Even if you don’t use predefined validation attributes in your data model, you can still use DevExpress Web API Service to validate user input. You can add custom data validation logic if you extend the basic implementation described in this article.

Note

This option of our Web API Service ships as part of the DevExpress Universal Subscription.

Validation API Availability

If you use DevExpress Web API Service endpoints to manage data and need to enable validation, use a specially designed IValidator service available in the following namespace: DevExpress.Persistent.Validation.

You can use the following methods to enable the service.

Enable the Validation Module in the Template Kit

If you use the Template Kit to create your Backend Web API project, you can enable the Validation module the the Additional Modules section. For additional information, refer to the following topic: Create a Standalone Web API Application.

Add the Validation Module to a Standalone Web API or XAF Blazor Application

Install the DevExpress.ExpressApp.Validation.Blazor NuGet package.

File: MySolution.WebApi\Startup.cs (MySolution.Blazor.Server\Startup.cs)

C# (Standalone WEB API Service)
C# (XAF Application Builder)

csharp

services.AddXafWebApi(builder => {
    //..
    builder.Modules
        .AddValidation(options => {
            //...
        })
    //...
}, Configuration);

csharp

services.AddXaf(Configuration, builder => {
    //..
    builder.Modules
        .AddValidation(options => {
            //...
        })
    //...
}

Validation Does Not Run Automatically

For performance optimization, CRUD endpoints don’t initiate data validation: you need to add that functionality.

Basic Data Validation Implementation

In a most basic scenario, you access your data using CRUD endpoints. When a user changes data, you enforce specified validation attributes in your data model.

The following example shows how you can enable such functionality. The code implements a custom IDataService. This service runs validation before it commits an object space (IObjectSpace).

For details about custom data services, please see the following article: Execute Custom Operations on Endpoint Requests.

csharp

using DevExpress.ExpressApp;
using DevExpress.ExpressApp.Core;
using DevExpress.ExpressApp.DC;
using DevExpress.ExpressApp.WebApi.Services;
using DevExpress.Persistent.Validation;
// ...
public class CustomDataService : DataService {
    readonly IValidator validator;
    public CustomDataService(IObjectSpaceFactory objectSpaceFactory,
     ITypesInfo typesInfo, IValidator validator) 
     : base(objectSpaceFactory, typesInfo) {
        this.validator = validator;
    }

    protected override IObjectSpace CreateObjectSpace(Type objectType) {
        IObjectSpace objectSpace = base.CreateObjectSpace(objectType);
        objectSpace.Committing += ObjectSpace_Committing;
        return objectSpace;
    }

    private void ObjectSpace_Committing(object? sender, 
      System.ComponentModel.CancelEventArgs e) {
        IObjectSpace os = (IObjectSpace)sender!;
        var validationResult = validator.RuleSet.ValidateAllTargets(
            os, os.ModifiedObjects, DefaultContexts.Save
        );
        if(validationResult.ValidationOutcome == ValidationOutcome.Error) {
            throw new ValidationException(validationResult);
        }
    }
}

Configure the Request Locale

You can use the HttpRequestMessage API to change the request locale. The invalid validation results you obtain from the service will use the locale you specified.

csharp

// ...
httpClient.DefaultRequestHeaders.Add("Accept-Language", "de-DE");
// ...

Add Unit Tests

Test Scenario

This example checks validation rules for XAF’s standard ApplicationUser class. XAF declares this class in all new projects that use the Security feature.

The ApplicationUser class applies a RuleRequiredField attribute to the UserName property. In other words, you cannot create a new user with an empty name.

The test tries to create an ApplicationUser object with an empty UserName property and receives a validation error.

This example uses the IDataService implementation demonstrated above. You can find the same test included in our MainDemo.EFCore demo application.

Step-by-Step Instructions

Follow the steps below to add a test to your solution:

If your solution does not include a testing project, add a new xUnit test project.
Add a reference to the {SolutionName}.Blazor.Server project.
Add the Microsoft.AspNetCore.Mvc.Testing package reference.
Add the following test to the xUnit project.