Input validation checks, before any processing, that the body, parameters, and query string match the expected format: presence, type, bounds. You never trust the client. A schema library like Zod, or a dedicated middleware, rejects invalid requests with a 400 or 422 code.
Example
const parsed = schema.safeParse(req.body);
if (!parsed.success) return res.status(400).json(parsed.error);