JSON Serialization vs Deserialization

Direct Answer

Serialization is the process of turning a Java value into JSON text or bytes. Deserialization is the opposite process: it reads JSON and builds a value of a declared Java type. In a REST API, serialization controls the response that leaves the service, while deserialization handles request data entering it; successful mapping still does not replace validation.

Deep Dive & Architecture

Serialization begins with a Java object graph, but the API should publish a deliberate representation rather than every reachable object. Bidirectional entity relationships can recurse, lazy associations can trigger unexpected queries, and broad visibility can expose data. A response DTO makes the outgoing shape finite and reviewable.

Deserialization begins with untrusted bytes. A parser checks JSON syntax, the mapper applies target-type rules, Bean Validation checks structural constraints, and the service enforces domain rules. These are separate stages. A syntactically valid request can still have an unknown product, insufficient stock, or an invalid state transition.

Round-tripping is not always lossless. A write-only request field may not appear in a response. Server-generated IDs and timestamps appear only after processing. Numbers or dates may use representations chosen for cross-language safety. The contract should describe each direction instead of promising that any serialized object can be deserialized into an equivalent entity.

Mapping tests catch accidental contract drift. Test representative output fields, missing and null input, unknown members according to policy, boundary numbers, and time-zone behavior. Tests should assert the public JSON rather than Jackson's incidental property discovery on a persistence model.

Code Example

import com.fasterxml.jackson.databind.ObjectMapper;

final class JsonDirectionExample {
    record CreateOrderRequest(String productId, int quantity) {}
    record OrderResponse(long id, String productId, String status) {}

    static String handle(String input) throws Exception {
        ObjectMapper mapper = new ObjectMapper();
        CreateOrderRequest request = mapper.readValue(
                input, CreateOrderRequest.class); // deserialization

        OrderResponse response =
                new OrderResponse(42, request.productId(), "created");
        return mapper.writeValueAsString(response); // serialization
    }
}

The request carries client input such as productId and quantity. The response has a server-generated ID and status, so it uses a different shape. Validation still belongs between the two mapping steps.