DTO

Data Transfer Objects define explicit shapes for crossing boundaries—HTTP requests, queue messages, gRPC payloads—separate from domain entities. They carry validation annotations or schemas, versioning fields, and serialization-friendly primitives. Mapping layers prevent leaking persistence models to public APIs.

On interviews: explain why you do not expose ORM entities directly. Discuss validation location, optional fields, and backward-compatible API evolution.

Common pitfalls: DTOs mirroring database tables one-to-one; missing mapping tests; giant shared DTO types used everywhere.

The trade-off is flexibility versus complexity—know when the simpler path is enough.

Checklist:

• Separate request, response, and domain models.
• Validate at boundary before domain logic.
• Version external contracts explicitly.
• Automate mapping tests for critical DTOs.