Pipes are classes that transform or validate input data before it reaches a route handler. They operate on the arguments of controller methods — either transforming them (e.g. string → number) or validating them (rejecting invalid data). Validation in NestJS is built on pipes.
()
() {
..(id);
}
Transformation pipes convert input to the right type (route params/query are always strings), failing with a 400 if conversion isn't possible.
// enable globally in main.ts
app.useGlobalPipes(new ValidationPipe({
whitelist: true, // remove properties not declared in the DTO
forbidNonWhitelisted: true, // throw if unknown properties are present
transform: true, // turn plain objects into DTO instances, convert types
}));
// with a DTO using class-validator decorators:
export class CreateUserDto {
@IsEmail() email: string;
@MinLength(8) password: string;
}
@Post()
create(@Body() dto: CreateUserDto) { // ValidationPipe validates the body automatically
}
The ValidationPipe reads the DTO's class-validator decorators and validates incoming data automatically — returning a detailed 400 error on failure, so your handler only ever receives valid data.
Request → ...middleware/guards/interceptors... → PIPES (transform/validate) → Handler
Pipes run JUST BEFORE the route handler, operating on its method arguments.
@Injectable()
export class TrimPipe implements PipeTransform {
transform(value: any) {
return typeof value === "string" ? value.trim() : value; // custom transformation
}
}
// usage: @Body(TrimPipe) ...
You implement PipeTransform's transform() method for custom validation/transformation logic.
@UsePipes(new ValidationPipe()) // method or controller level
@Param("id", ParseIntPipe) // parameter level
app.useGlobalPipes(new ValidationPipe()) // global (most common for validation)
Pipes are a key NestJS feature for handling input safely, and they're the foundation of the framework's validation system.
Understanding them is essential because nearly every API endpoint needs to validate and transform input: transformation pipes (ParseIntPipe, etc.) ensure parameters are the correct type, and — most importantly — the ValidationPipe combined with DTOs provides automatic, declarative validation of request bodies against class-validator rules, rejecting invalid or malicious input with clear errors before it reaches your business logic.
This is critical for both security (validating/sanitizing untrusted input, stripping unexpected properties) and robustness (handlers only receive valid data).
Knowing how to enable the global validation pipe with sensible options (whitelist, transform), use built-in transformation pipes, and write custom pipes is fundamental for building safe, well-structured NestJS APIs — pipes and validation are everyday, must-know concepts in the framework.