Next.js 16 App Router route handler + Zod validation: working versions (tested 2026-10-15)

{
  "name": "nextjs-route-handler-zod",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "next": "16.4.1",
    "zod": "4.6.7",
    "react": "19.3.1",
    "react-dom": "19.3.1"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2"
  }
}

import { NextResponse, type NextRequest } from "next/server";
import { z } from "zod";

const CreateTodo = z.object({ title: z.string().trim().min(1).max(120), done: z.boolean().default(false) });
const ListQuery = z.object({ limit: z.coerce.number().int().min(1).max(50).default(10) });

const todos: { id: number; title: string; done: boolean }[] = [];

export async function POST(req: NextRequest) {
  let body: unknown;
  try { body = await req.json(); } catch { return NextResponse.json({ error: "invalid_json" }, { status: 400 }); }
  const parsed = CreateTodo.safeParse(body);
  if (!parsed.success) return NextResponse.json({ error: "invalid_body", issues: z.flattenError(parsed.error).fieldErrors }, { status: 400 });
  const todo = { id: todos.length + 1, ...parsed.data };
  todos.push(todo);
  return NextResponse.json(todo, { status: 201 });
}

export async function GET(req: NextRequest) {
  const q = ListQuery.safeParse(Object.fromEntries(req.nextUrl.searchParams));
  if (!q.success) return NextResponse.json({ error: "invalid_query" }, { status: 400 });
  return NextResponse.json(todos.slice(0, q.data.limit));
}

import { test } from "node:test";
import assert from "node:assert/strict";
import { NextRequest } from "next/server";
import { GET, POST } from "../app/api/todos/route.ts";

const post = (body: string) => POST(new NextRequest("http://localhost/api/todos", { method: "POST", body, headers: { "content-type": "application/json" } }));

test("creates a todo with defaults", async () => {
  const res = await post(JSON.stringify({ title: "  ship it  " }));
  assert.equal(res.status, 201);
  assert.deepEqual(await res.json(), { id: 1, title: "ship it", done: false });
});

test("400 on bad body and bad JSON", async () => {
  const bad = await post(JSON.stringify({ title: "" }));
  assert.equal(bad.status, 400);
  assert.ok((await bad.json()).issues.title);
  assert.equal((await post("{oops")).status, 400);
});

test("validates and coerces query params", async () => {
  assert.equal((await GET(new NextRequest("http://localhost/api/todos?limit=1"))).status, 200);
  assert.equal((await GET(new NextRequest("http://localhost/api/todos?limit=999"))).status, 400);
});