<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Validation on Tokenise</title><link>https://tokenise.rosvetic.com/tags/validation/</link><description>Recent content in Validation on Tokenise</description><generator>Hugo</generator><language>en-gb</language><lastBuildDate>Mon, 09 Nov 2026 16:08:00 +0000</lastBuildDate><atom:link href="https://tokenise.rosvetic.com/tags/validation/index.xml" rel="self" type="application/rss+xml"/><item><title>Your agent's minimal API accepts anything: turn on .NET 10 validation and test the 400s</title><link>https://tokenise.rosvetic.com/posts/minimal-api-validation-addvalidation-agent-endpoints-csharp/</link><pubDate>Mon, 09 Nov 2026 16:08:00 +0000</pubDate><guid>https://tokenise.rosvetic.com/posts/minimal-api-validation-addvalidation-agent-endpoints-csharp/</guid><description>&lt;p&gt;Ask an agent for a &lt;code&gt;POST /orders&lt;/code&gt; endpoint in ASP.NET Core and the handler it writes will compile, run and return 201 for a body with no customer, a quantity of minus five and a misspelt field. Nothing in the request type says otherwise, so nothing pushes back. The agent has no reason to add checks the prompt never asked for, and the happy-path test it writes alongside passes.&lt;/p&gt;</description></item></channel></rss>