response_model iku kanggo apa?

Question

Accepted Answer

Parameter **`response_model`** menyatakan bentuk saka response saka endpoint. FastAPI nggunakake kanggo **validasi, filter, lan serialize** data sing dikembalikan — lan kanggo dokumentasi response ing API docs. Tugas paling penting: ndheketake mung field sing dikarepi ae (contone, ngati password ora bocor).

## Masalah: bocornya field sensitif

```python
class User(BaseModel):
    name: str
    email: str
    password: str        # ⚠️ should NEVER be in the response!

@app.get("/users/{id}")
def get_user(id: int) -> User:
    return db.get_user(id)   # returning the full object would expose the password
```

## Solusi: model response terpisah

```python
class UserOut(BaseModel):    # the SAFE public shape — no password
    name: str
    email: str

@app.get("/users/{id}", response_model=UserOut)
def get_user(id: int):
    return db.get_user(id)   # returns a full user, but FastAPI FILTERS it to UserOut
# response → { "name": "...", "email": "..." }  — password stripped automatically
```

Karo `response_model=UserOut`, FastAPI njupuk apa sing dikembalikan lan **nfilter mudhun** menyang mung field sing dinyatakake ing `UserOut` — mula password (lan field tambahan liyane) dibusak saka response, sanajan dikembaliken object lengkap.

## Apa sing ditindakake response_model

```text
✓ FILTERS the output to only the declared fields (key for hiding sensitive data)
✓ VALIDATES that your response matches the declared schema (catches mistakes)
✓ SERIALIZES the data to JSON correctly
✓ DOCUMENTS the response shape in the OpenAPI/Swagger docs
```

## Alternatif modern: anotasi tipe kembalian

```python
@app.get("/users/{id}")
def get_user(id: int) -> UserOut:    # the -> return type works like response_model
    return db.get_user(id)
# response_model_exclude_unset=True → omit fields not explicitly set
```

## Mengapa penting

`response_model` penting kanggo keamanan lan desain API sing bersih.

Tugas paling kritis: nyegah bocoran data aksidental — kanthi nyatakake persis field apa sing kudu ana ing response, FastAPI nfilter kabeh liyane (kaya password hash, tanda internal, utawa token) sanajan kode mu malah malah ngmbalekake object database lengkap, ngilangan kerentanan umum lan serius.

Leuwih saka iku, validasi response-mu marang schema sing dinyatakake (ngunci bug nang dikembaliken bentuk salah), ndheketake serialisasi sing bener, lan dokumentasi response ing auto-generated API docs.

Pola nggunakake model input lan output terpisah (karo `response_model` ngontrol apa sing exposed) mangrupikeun best practice kanggo API sing aman lan well-defined, nggaweke pengetahuan penting kanggo endpoint apa pun sing mengembalikan data.