If I was writing the REST client, I would expect an "HTTP 400 Bad Request" from the server. And if I was writing java code invoking some client-side library that ultimately places REST calls to a server, I would expect some
There is nothing in this question which is specifically pertinent to java, or to REST APIs, (*) or to client-side programming, or to server-side programming. The fact is, you are programming against an interface. An interface is two things:
- An interface is an abstraction.
As an abstraction, the interface should preferably hide all implementation-specific details from the caller. With respect to parameter validation, this is a gray area, because for each parameter you have to consider whether its limits are what they are due to the nature of the interface, or due to peculiarities of the implementation. For example, if the server offers a deck of cards, then a limit of 50 would be a peculiarity of the implementation, since decks of cards normally have 52 cards, or 54 if jokers are allowed. If the limit was 52, then you could say that this is an interface for a deck of cards without jokers, and consider the limit to be part of the interface.
So, to sum up, if a limit can be included in the implementation-agnostic description of the interface, then by all means validate it. If not, skip it and let the implementation validate it. But be sure to first read the next section.
- An interface is contract.
If you were to let the other side do as it pleases, without ever checking to see whether they are honoring their side of the contract, you are setting yourself up to be taken advantage of. Your life is going to be hard.
As a matter of fact, common decency dictates that you should check everything you can reasonably check even on your outbound calls, so as to:
ensure that you are never violating the contract from your side, and
know when you did something wrong without having to rely on the other side doing their job properly and validating your calls.
(*) Would this nasty habit of saying "API" while in fact meaning "REST API" die a nasty death? thanks!