Context
A frontend compiles successfully, but an integration sends a string where the application expects a number. The compiler checked the application's declared types; it did not establish that the external sender honored the contract.
Name the boundary before the interface
List inputs that cross trust boundaries: browser forms, third-party responses, webhook bodies, imported files and environment configuration. Decide where each value becomes an accepted internal business object. That decision is more useful than adding type assertions throughout the application.
The TypeScript handbook explains unknown values, narrowing and the absence of runtime checking in type assertions. Treat an external value as untrusted until application code or a suitable validation library has checked the parts needed by the workflow.
Define a narrow accepted shape
For an expense request, validate the amount representation, currency, date, description length and attachment references. Reject or deliberately ignore unsupported fields according to the API contract. Do not allow a supplied status or approver ID to bypass the approval workflow.
Separate formatting from business rules. A date can be syntactically valid yet fall outside an allowed accounting period. An amount can be numeric yet exceed the current user's authorization. Both kinds of checks belong in the request's acceptance criteria.
Make errors useful without exposing internals
Return a clear field-level explanation where appropriate, such as an unsupported currency or missing description. Keep database details, stack traces and secret configuration out of public responses. Retain a correlation reference that lets support investigate the failure safely.
Test more than the happy path
Build a small fixture set: missing values, null values, empty strings, oversized descriptions, unexpected nesting, unknown enum values and additional privileged fields. Check that invalid input does not partially create the expense or publish a downstream event.
Then test a valid request from the actual integration client. Validation that rejects every payload is safe from one perspective but unusable in practice. Keep the API contract and its examples synchronized as the business workflow changes.
Explore JavaScript and TypeScript development and API integration services.
Technical references
TypeScript basic types, unknown and assertions and control-flow narrowing.