Apply [ApiController] to an ASP.NET Core controller to enable web API conventions. One important convention handles invalid request input automatically: the framework returns an HTTP 400 response before the action method runs. [ApiController] is separate from attributes such as [Route] and [HttpGet], which specify routes and HTTP verbs. section 1.2.3 section 6.2.1
For each request, the relevant validation flow is:
- Model binding converts incoming values into action parameters. A binding failure produces an HTTP 400 response. section 6.2.1
- Validation checks the bound input against built-in or custom rules and records errors in ModelState. section 6.2.1 section 6.4
- If ModelState is valid, the action runs. If it is invalid, [ApiController] returns HTTP 400 without calling the action. section 6.2.1
An invalid query value
If a client sends the word "string" for a numeric pageIndex parameter, the response has status 400 and identifies pageIndex and its rejected value in a validation-error body. The action does not need code to construct that response. section 6.2
Automatic HTTP 400 responses are useful until an action needs a different response for a particular validation failure. Removing [ApiController] would let the action inspect invalid ModelState, but would also discard its other conventions. Instead, suppress the automatic invalid-ModelState filter, then check ModelState in the action and choose a response. The shown configuration applies to all controllers; a custom action-level filter convention is another way to limit the change. section 6.2.3
builder.Services.Configure<ApiBehaviorOptions>(options => options.SuppressModelStateInvalidFilter = true); var app = builder.Build();
Place this configuration in Program.cs before building the app to suppress automatic invalid-ModelState responses while retaining [ApiController]. Actions must then handle invalid ModelState where a response is needed. section 6.2.3
