加载并验证输入负载

Going the other way, turning incoming JSON into trusted Python data is called loading. The schema both parses and checks the payload.

Pass a request dict to the schema's load method. It validates every field and returns clean data, raising an error if something is wrong.

If a field marked required is missing, load refuses the payload. You never reach your business logic with half-built input.

Send a string where an Int is expected and load rejects it. The field type becomes a guarantee, not just documentation.

When input fails, Marshmallow raises a ValidationError. Wrap load in try-except so you can answer with a helpful 400 response.

The exception carries a messages dict keyed by field. Return it as JSON so clients know exactly which inputs were invalid and why.

Built-in validate helpers tighten the rules, like requiring a minimum length or a value range, without writing your own checks.

A password should be accepted on input but never returned. Mark it load_only so load reads it while dump leaves it out.

By default, extra keys in the payload raise an error. This strictness stops clients from sneaking in fields you never meant to accept.

After load succeeds you hold validated data. Use it to build a new model, often with unpacking straight into the constructor.

Now one schema dumps objects out and loads payloads in. Your endpoints share a single, trusted contract for the whole resource.

Use load to validate and parse incoming JSON, catch ValidationError for clean 400s, and add validators and load_only for safe, robust input.