How would you answer an interview scenario involving model binding and validation in Web API?

I would bind incoming JSON to a dedicated request DTO, validate structural constraints at the API boundary, and keep business validation in the application or domain layer. For CreateOrder, required fields and numeric ranges can be validated immediately, while a rule such as available credit requires application logic and data access. I would return a consistent validation response and avoid binding persistence entities directly to prevent over-posting.