title: How to handle Resource validation in REST webservices?
body: <p>I'm building a REST webservice in Java using Spring, Jersey and Hibernate (JPA).</p>
  
  <p>Now I'm trying to add support for validation in my resources. JSR-303 (Bean validation) naturally appeared as a suitable choice (I'm using Hibernate Validator which is the reference implementation of JSR-303). However, I'm trying to consolidate some concepts first.</p>
  
  <p>It seems to me that there are at least two kinds of possible validations:</p>
  
  <ul>
  <li><strong>Regular validation on fields</strong>, e.g. check that a property isn't null, check if a <code>String</code> property is a valid e-mail, check if an <code>Integer</code> property is greater than <code>10</code>, etc. This is working as expected. I've registered a JAX-RS ExceptionMapper which maps <code>javax.validation.ConstraintViolationException</code>'s into proper HTTP responses.</li>
  <li><strong>Data Integrity Validation</strong></li>
  </ul>
  
  <p>I'll explain what I mean exactly by "Data Integrity Validation" with an example. This happens when there are relationships between two or more resources. Imagine two resources: a <code>Product</code> and a <code>Category</code>. A <code>Product</code> <strong>has</strong> a <code>Category</code>. When the client sends to the server the representation of the <code>Product</code> to create (a POST HTTP request), it must inform the <code>Category</code> of the product. The client must know the categories beforehand, of course. Imagine in JSON something like:</p>
  
  <pre><code>{
     "quantity": "10",
     "state": "PRODUCED",
     "category": {
        "id": "123"
     }
  }
  </code></pre>
  
  <p>Well, the category with id <code>123</code> might not exist. If we try to insert this into the database, obviously we get a foreign key related exception. So I assume we have to validate these issues and return a proper message to the client, just as in regular property validations.</p>
  
  <hr>
  
  <p>Now, my main questions are:</p>
  
  <ol>
  <li>Right now I'm performing the validation in the Data Access level, through JPA's integration with Bean Validation. Should the validations be done <strong>before/after serializations processes</strong>, <strong>before/after database operations</strong> or <strong>both</strong>?</li>
  <li><strong>How to handle <em>Data Integrity Validations</em>?</strong> Manually? (i.e. explicitly consulting the database checking data integrity) Or should we just try to insert it anyway and then catch database (or DAO) exceptions? Bean Validation has nothing to do with this kind of validation, right?</li>
  <li>If you have any experience with JAX-RS/REST and Bean Validation I would be glad if you let me know. Using groups?</li>
  </ol>
  
  <p><em>These questions are somewhat related to Java, but I was also hoping to get some new perspectives on these matters. Some technology independent ones. :)
  It would be great if you could provide your own solutions for these problems on your REST webservices.</em></p>