Under-posting (ARCH805)

Key dotnet.api.under-posting · Severity warning · Category api

Flags non-nullable value-type properties (int, bool, DateTime, Guid, enums) of models a controller action reads from the request body when nothing makes them mandatory. A client that omits the field sends the type’s default and the action cannot tell it from a real value. [Required] alone does not help on a non-nullable value type - make it nullable with [Required], declare it required, or add [JsonRequired].

Incorrect

public class CreateOrderRequest
{
    public int Quantity { get; set; }       // missing field arrives as 0
    public bool GiftWrap { get; set; }
}

Correct

public class CreateOrderRequest
{
    [Required]
    public int? Quantity { get; set; }
    public required bool GiftWrap { get; init; }
}