What's New in ASP.NET Core 10 Minimal APIs: Built-In Validation, SSE, and Form Improvements
Minimal APIs arrived in .NET 6 as a leaner alternative to controllers. They delivered on performance and startup simplicity, but teams coming from a controller background quickly ran into the gaps: no built-in request validation, no native Server-Sent Events support, and rougher handling of form data. Most teams either bolted on FluentValidation manually or reluctantly kept controllers for endpoints that needed validation.
🎁 Want production-ready .NET source code and exclusive tutorials? Join Coding Droplets on Patreon for premium content delivered every week. 👉 Join CodingDroplets on Patreon
ASP.NET Core 10 closes three of the most requested gaps. This article covers what changed, what it means for your team, and how to decide whether to adopt each feature.
Built-In Validation — The Biggest Change
The most significant addition is first-class validation support for Minimal APIs using Data Annotations. Prior to .NET 10, [Required], [Range], [MaxLength] and the rest of the Data Annotations attributes were simply ignored when used on parameters bound to Minimal API endpoints. You had to either add FluentValidation with a custom filter or validate manually inside the handler.
.NET 10 changes this with a single service registration.
How to enable it:
Register the validation service in your Program.cs:
builder.Services.AddValidation();
That single call activates validation for all Minimal API endpoints in the application. No per-endpoint configuration, no additional packages, no custom middleware.
What it validates:
Once enabled, the framework validates request models that have Data Annotations attributes before the handler executes. A request that fails validation returns a 400 Bad Request with a ValidationProblemDetails response body — the same structured format that controllers have used for years.
The framework also supports IValidatableObject for cross-property validation rules. If your request model implements IValidatableObject, the Validate method is called as part of the validation pipeline, allowing conditional rules that depend on multiple fields together.
Opting out per endpoint:
If you need to bypass validation on a specific endpoint — for performance, or because the endpoint handles raw input — call .DisableValidation() on the route builder:
app.MapPost("/raw-upload", handler).DisableValidation();
What this means for existing applications:
Teams that already use FluentValidation via a custom filter or endpoint filter can continue doing so. The built-in validation is additive, not a replacement. FluentValidation still offers more expressive rules, async validators, and the ability to test validators in isolation. The built-in validation is most valuable for simpler models where Data Annotations are sufficient and you want to eliminate the setup overhead.
Server-Sent Events — TypedResults.ServerSentEvents
Server-Sent Events (SSE) allow a server to push data to a client over a long-lived HTTP connection. Prior to .NET 10, implementing SSE in a Minimal API required manually setting the response headers, writing to the response stream, and managing the connection lifecycle. It worked but it was low-level and error-prone.
.NET 10 introduces TypedResults.ServerSentEvents — a first-class result type that handles the SSE protocol correctly.
What it handles for you:
Setting the correct Content-Type: text/event-stream header. Flushing data to the client as each event is produced. Keeping the connection alive until the server or client closes it. Properly formatting the SSE event stream with data: prefixes and double newlines.
Typed vs untyped streams:
The API supports both typed and untyped event streams. The typed variant serialises each event object to JSON automatically, making it straightforward to push structured data. The untyped variant gives you full control over the raw string content of each event.
Team considerations:
SSE is appropriate for one-directional real-time data flows: live dashboards, progress tracking, notification feeds, stock prices, log tailing. For bidirectional communication, SignalR remains the right choice. The new TypedResults.ServerSentEvents API makes the common SSE pattern significantly simpler to implement correctly in Minimal APIs.
Form Post Improvements
Minimal APIs in earlier versions had limitations around form data binding. Complex form models with multiple fields required manual extraction from IFormCollection. File uploads needed explicit binding declarations. Error messages for form binding failures were less informative than their controller counterparts.
.NET 10 brings Minimal API form handling closer to parity with controllers:
Improved model binding for form data: Complex form models can be bound automatically without needing to extract each field from IFormCollection manually. The binding conventions align more closely with what controller developers already know.
Better file upload support: File binding via IFormFile works more naturally in the endpoint signature without extra attributes.
Clearer binding failure messages: When form data cannot be bound, the error responses now provide more actionable information about which fields failed and why.
These improvements do not fundamentally change how form handling works — they reduce the friction for teams migrating form-heavy endpoints from controllers to Minimal APIs.
What Has Not Changed
It is worth being explicit about what .NET 10 does not change for Minimal APIs.
FluentValidation remains the better choice for complex validation. Built-in validation covers Data Annotations and IValidatableObject. If your team uses async validators, validators that query a database, or validators with complex conditional logic, FluentValidation via an endpoint filter is still the right approach.
The performance characteristics are the same. Minimal APIs were not re-architected in .NET 10. The performance advantages that made them attractive — lower overhead than controllers for high-throughput scenarios — remain unchanged.
Clean Architecture integration is unchanged. Teams using MediatR with Minimal APIs, or structuring endpoints as thin dispatchers to handlers, do not need to change their architecture.
Adoption Decision
Adopt built-in validation if: Your request models use Data Annotations and you want to eliminate manual validation boilerplate. Your team is already familiar with the Data Annotations model from controller development.
Keep FluentValidation if: You have existing validators, async validation requirements, or complex cross-field rules. The migration cost outweighs the benefit of using the built-in approach.
Adopt TypedResults.ServerSentEvents if: You are building any one-directional real-time feature — dashboards, notifications, progress streams. The new API is strictly better than the manual approach.
Adopt form improvements gradually: If you have working form handling today, there is no urgency to change it. The improvements are most relevant for new endpoints or migrations from controllers.
FAQ
Q: Do I need to update to .NET 10 to use built-in validation in Minimal APIs? Yes. Built-in validation support via AddValidation() is a .NET 10 feature. It is not available in .NET 8 or .NET 9.
Q: Does AddValidation() affect controller validation? No. Controller validation uses [ApiController] and the MVC model binding pipeline, which is separate. AddValidation() only activates the new Minimal API validation pipeline.
Q: Can I use both built-in validation and FluentValidation in the same application? Yes. They operate independently. Built-in validation runs on endpoints that do not call .DisableValidation(). FluentValidation can be applied via endpoint filters on specific routes.
Q: Is TypedResults.ServerSentEvents production-ready in .NET 10? Yes. It shipped as a stable API in .NET 10. It is appropriate for production use wherever SSE is a suitable transport.
Q: Does the form improvement work with multipart uploads? Yes. The improvements include better handling of multipart form data, including file uploads via IFormFile, bringing Minimal API form handling closer to the controller experience.
Q: Can I test the built-in validation with WebApplicationFactory? Yes. Integration tests using WebApplicationFactory will exercise the full validation pipeline including the new built-in validation. Unit testing the validators themselves follows the same Data Annotations testing patterns you already know.
☕ Found this guide useful? Buy us a coffee — it keeps the content coming every week.
