A server-side property is a field whose value and authority belong to the server. Payment identifiers and statuses are examples: clients may receive them, but must not control them. section 6.5
The risk appears when one data model represents both request and response payloads. Optional server-managed fields can then enter user input, allowing a client to submit values such as status: settled instead of letting the server determine payment state. section 6.5
Payment creation
Accept amount and currency in POST /payments, then return a payment containing its generated id and status. Define a MakePayment input model with only client-controlled fields, use Payment for output, and reject additional properties.
