Path Variables, Query Parameters, Headers and Bodies

Bind input with @PathVariable, @RequestParam (with defaults and required=false), @RequestHeader and @RequestBody. Spring converts types automatically and returns 400 for conversion errors. For pagination, accept a Pageable parameter (Spring Data web support) and cap the maximum page size.

@GetMapping("/api/v1/orders")
Page<OrderSummary> list(
        @RequestParam(defaultValue = "PAID") OrderStatus status,
        @RequestParam(required = false) @Size(max = 100) String q,
        @RequestHeader(name = "X-Tenant-Id") String tenantId,
        @PageableDefault(size = 20, sort = "createdAt", direction = Sort.Direction.DESC) Pageable pageable) {
    return orders.search(tenantId, status, q, pageable);
}

spring:
  data:
    web:
      pageable:
        max-page-size: 100      # clients can't request 1,000,000 rows

Common pitfalls

• Unbounded page sizes.
• Allowing sorting by any property from user input without restrictions.
• Expecting validation annotations on parameters to work without @Validated on the controller (needed for older Boot versions).

Key points

• Annotations bind each input type
• Pageable with max page size
• Conversion errors → 400

Further reading: Spring MVC: @RequestParam