FastAPI uses Pydantic models for request validation — if the body does not match the schema, it returns 422 with field-level errors automatically. response_model= strips extra fields from responses, preventing accidental data leakage.

FastAPI reads Pydantic field annotations and validates every incoming request automatically. Declare the expected shape as a class with type-annotated fields and FastAPI does the rest. response_model is critical for security — it ensures that fields like password hashes or internal IDs are never exposed even if the ORM returns them. async def routes run on the event loop; regular def routes auto-run in a threadpool so they do not block the loop. Key status codes: 200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 422 Validation Error, 429 Too Many Requests.