Is there any way to validate path parameters in AWS API Gateway?

Question

I'm using AWS API Gateway to create an api. I have the following path for an API: /users/{id}

Is there a way to validate the existence of id in the API request made and maybe its type in API Gateway before it reaches the Lambda integration? I understand API Gateway supports validating request body, query params and headers, but I can't see any option for path parameters, does API Gateway not support that?

I'm going through the documentation and I can't seem to find something clear on that.

Answer 1

API Gateway can check if a path parameter exists or not. It can check if path includes any "id", but it cannot for example check what is it’s regex pattern. Such validation should be made on a client side. Either the API Gateway path follows the defined pattern, in which case it can route you to an appropriate resource, or not. It can however ensure that request parameters are present and non-blank.

The AWS documentation states that API Gateway can perform the basic validation:

API Gateway can perform the basic validation. This enables you, the API developer, to focus on app-specific deep validation in the backend. For the basic validation, API Gateway verifies either or both of the following conditions:

• The required request parameters in the URI, query string, and headers of an incoming request are included and non-blank.
• The applicable request payload adheres to the configured JSON schema request model of the method.

To enable basic validation, you specify validation rules in a request validator, add the validator to the API's map of request validators, and assign the validator to individual API methods.

Note that comparison with JSON schema request model refers to the request payload, and not to request parameters. In the documentation you can find guidance on how to enable request validation in API Gateway:

• by importing OpenAPI definition
• using the API Gateway REST API
• using AWS console

Also, follow this blog post which explains how to set up request parameters validation. Mind however, that the basic validation ensures that the request parameters are present and non-blank. More advanced validation, like checking regex pattern or type, is not possible to my knowledge.