How I Structure a Spring Boot REST API for Production

A production Spring Boot API is less about clever code and more about boundaries: where validation happens, where transactions begin, and where errors become responses. Here is the layering I reach for by default.

Layering

Controller → Service → Repository, with DTOs at the edge. Controllers stay thin: they bind and validate input, then delegate. Services own transactions and business rules. Repositories own persistence. Entities never leak past the service layer.

Validation

Use Bean Validation on request DTOs so bad input is rejected before it reaches business logic.

public record CreateOrderRequest(
    @NotBlank String customerId,
    @Positive int quantity) {}

Error handling

Centralize errors with @RestControllerAdvice so every failure maps to a consistent response shape — clients should never see a stack trace.