A data-transfer object (DTO) is a class shaped for information crossing an API boundary. It can carry the data a client needs without making a database entity double as the API’s request or response format. A simple weather-forecast DTO, for example, lets a controller serve strongly typed JSON. section 5.5.1 section 2.4
For a board-game response, create a /DTO/ folder and two classes. LinkDTO holds a link’s address, relationship, and HTTP method. RestDTO<T> holds Data of type T alongside a list of Links. The T is a placeholder: a controller can return RestDTO<BoardGame[]> when its data is an array of board games. This replaces a quick anonymous response with a consistent shape that can tell clients where to go next. section 3.1.6 section 3.5
Listing 3.3 RestDTO.cs file
namespace MyBGList.DTO
{
public class RestDTO<T>
{
public List<LinkDTO> Links { get; set; } = new List<LinkDTO>();
public T Data { get; set; } = default!;
}
}
RestDTO<T> shows the reusable response shape: typed Data and an initialized list of LinkDTO objects. section 3.1.6
Updating a board game
Create BoardGameDTO with a required Id to find the record and optional Name and Year values to change. Accept it as the POST action’s input, find the entity, apply supplied changes, update its modification date, and save. The DTO describes what the client may send; the entity remains the database-facing class. In this implementation, the action returns a RestDTO containing the resulting BoardGame entity, so introducing an input DTO does not by itself separate every response from entities. section 5.5.1
Keeping DTOs separate matters when entities have fields clients should neither see nor transmit, such as password hashes or personal data. Define the fields for each exchange rather than relying on an entity’s full set of properties. section 5.5.1
Registering an account
RegisterDTO accepts a username, email address, and password. Required-field and email-address attributes describe input requirements; the registration action checks ModelState before creating a user. A malformed email demonstrates DTO validation, while password rules can still reject an otherwise valid request later. section 9.2.6
