Most API routes destructure await request.json() and pass values into SQL without type checking, length limits, or schema validation. Adding zod schemas per route would catch malformed requests early and produce better error messages.