Data validation checks, on the server side, that a request's inputs follow the expected rules: required fields, types, formats, lengths, allowed values. An invalid request is rejected with a suitable code (400 or 422) and a message detailing the fields in error.
Example
email: required, email format; age: integer between 0 and 120