Skip to content
Sarj Sarj Sarj Standards

require-pydantic-for-structured-payload

Structured nested FastAPI payloads must be parsed into a named Pydantic model before field access.

SARJ450 Rule source Tests Catalog JSON

Why

A validated outer request does not validate the shape of an open nested mapping; fixed-key reads bypass the route's declared contract.

Fix

Validate the nested value with PayloadModel.model_validate(...) or TypeAdapter(PayloadModel).validate_python(...), then use typed attributes.

Examples

Before — flagged A route reads a fixed key from a nested request mapping
app/routes.py
from fastapi import APIRouter


router = APIRouter()




@router.post("/actions")
def action(body: RequestModel):
    payload = body.payload
    return payload.get("nameOnCard")
After — preferred A route validates a nested request model
app/routes.py
from fastapi import APIRouter


router = APIRouter()




@router.post("/actions")
def action(body: RequestModel):
    payload = CardPayload.model_validate(body.payload)
    return payload.name_on_card