DTO Pattern — Why Never Expose Entities Directly in REST APIs
Fast recall
Quick revision
Core answer
Whether the candidate understands the coupling problems of exposing entities and can explain the separation of concerns.
Exposing JPA entities directly and hitting LazyInitializationException when Jackson serializes a lazy collection outside the persistence context.
Mention MapStruct for compile-time mapping, explain record classes as DTOs, and discuss the difference between request DTOs and response DTOs.
Interview-ready guide
Interview answer
DTOs (Data Transfer Objects) are the boundary between your HTTP layer and your domain/persistence layer. Skipping them is a shortcut that creates API coupling to database schemas and security vulnerabilities.
Why not expose entities directly
@JsonIgnoreand@JsonPropertyon entity fields create maintenance overhead as the schema evolves- Bidirectional
@OneToManyrelationships cause infinite recursion during JSON serialization - Lazy-loaded fields trigger additional SQL queries inside the Jackson serializer — N+1 inside the serializer
- API consumers see internal field names and column-level details that break when you refactor the database
Request vs response DTOs
- Request DTO: fields needed to perform the operation, with validation annotations; fields the client is not allowed to set (like
createdAt) are absent - Response DTO: fields the client needs to see, potentially aggregated from multiple entities, with no persistence metadata
Mapping options
- MapStruct: annotation processor generates compile-time implementation; zero reflection; method signature = mapping contract
- ModelMapper: runtime reflection; simpler setup; harder to debug; slower
- Manual mapping: explicit but verbose; acceptable for small projects
Java records (record OrderResponse(Long id, String status) {}) are the cleanest response DTO — immutable, compact, and Jackson-serializable without configuration.
DTO Pattern — Why Never Expose Entities Directly in REST APIs
Direct Answer
Exposing JPA entities directly in API responses couples your database schema to your API contract, leaks internal fields (like password hashes), triggers lazy loading exceptions, and makes API evolution impossible without database migration. DTOs create a boundary between internal representation and external contract, letting each evolve independently.
Common Mistakes & Pitfalls
Exposing JPA entities directly and hitting LazyInitializationException when Jackson serializes a lazy collection outside the persistence context.
Check your understanding
Answer these without looking back at the article.
- What are the trade-offs when applying DTO Pattern — Why Never Expose Entities Directly in REST API in production?
- What are the trade-offs when applying DTO Pattern — Why Never Expose Entities Directly in REST API in production?
- What are the trade-offs when applying DTO Pattern — Why Never Expose Entities Directly in REST API in production?
Related interview prep categories
1Want a guided curriculum order?
These modules are also sequenced in our flagship backend interview track — open it when you prefer an ordered path instead of browsing by topic.