Validating Requests and Building REST Endpoints

Combine Zod schemas, typed handlers, and the async wrapper into full, validated REST endpoints.

A validation middleware factory

TypeScript

import { Request, Response, NextFunction } from 'express';
import { z } from 'zod';

function validateBody<T extends z.ZodTypeAny>(schema: T) {
  return (req: Request, res: Response, next: NextFunction) => {
    const result = schema.safeParse(req.body);
    if (!result.success) {
      res.status(400).json({ error: result.error.flatten() });
      return;
    }
    req.body = result.data; // now the validated, typed value
    next();
  };
}

import { Request, Response, NextFunction } from 'express';
import { z } from 'zod';

function validateBody<T extends z.ZodTypeAny>(schema: T) {
  return (req: Request, res: Response, next: NextFunction) => {
    const result = schema.safeParse(req.body);
    if (!result.success) {
      res.status(400).json({ error: result.error.flatten() });
      return;
    }
    req.body = result.data; // now the validated, typed value
    next();
  };
}

safeParse never throws, it returns { success: true, data } or { success: false, error }, which suits middleware better than .parse()'s throw-based style, a bad request is an expected outcome here, not an exceptional one. <T extends z.ZodTypeAny> makes validateBody reusable for any schema, not just one hard-coded shape.

Wiring up the endpoints

TypeScript

const tasks: Task[] = [];

app.get('/tasks', (_req, res) => {
  res.json(tasks);
});

app.get('/tasks/:id', asyncHandler(async (req: Request<{ id: string }>, res) => {
  const task = tasks.find((t) => t.id === req.params.id);
  if (!task) {
    res.status(404).json({ error: 'Task not found' });
    return;
  }
  res.json(task);
}));

app.post('/tasks', validateBody(CreateTaskSchema), asyncHandler(async (req, res) => {
  const task: Task = { id: crypto.randomUUID(), done: false, ...req.body };
  tasks.push(task);
  res.status(201).json(task);
}));

const tasks: Task[] = [];

app.get('/tasks', (_req, res) => {
  res.json(tasks);
});

app.get('/tasks/:id', asyncHandler(async (req: Request<{ id: string }>, res) => {
  const task = tasks.find((t) => t.id === req.params.id);
  if (!task) {
    res.status(404).json({ error: 'Task not found' });
    return;
  }
  res.json(task);
}));

app.post('/tasks', validateBody(CreateTaskSchema), asyncHandler(async (req, res) => {
  const task: Task = { id: crypto.randomUUID(), done: false, ...req.body };
  tasks.push(task);
  res.status(201).json(task);
}));

Every layer does one job: validateBody rejects malformed input before the handler ever runs, asyncHandler catches anything the handler itself throws, and the handler is left to assume req.body is already a valid CreateTaskInput, because by the time it runs, Zod already checked that.

Status codes that mean something

Code	When
`200`	Successful GET/PATCH
`201`	Successful POST that created something
`400`	The request body failed validation
`404`	The requested resource doesn't exist
`500`	An unexpected server error (caught by `errorHandler`)

WARNING

Validating inputs (req.body, req.params) is the priority, but don't skip checks on values you construct yourself either, tasks.find(...) returning undefined is exactly the kind of case the 404 branch above exists to catch, TypeScript's strict mode will actually force you to handle it.

Validating Requests and Building REST Endpoints

A validation middleware factory

Wiring up the endpoints

Status codes that mean something

📝 Validated Endpoints Quiz