When you fetch the data from the request. Validate based on what it contains and what it can have.